[SCM] libav/experimental: check data_size in decode_frame()

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit 0d31833d043613e7fc6370c3a703c69d2fff874e
Author: Michael Niedermayer <michaelni at gmx.at>
Date:   Wed Sep 23 11:29:38 2009 +0000

    check data_size in decode_frame()
    
    Originally committed as revision 19986 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 2ba47df..6f451c3 100644
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -2276,6 +2276,9 @@ static int decode_frame(AVCodecContext * avctx,
     avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
+        return -1;
+
     if(s->frame_size<=0 || s->frame_size > buf_size){
         av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
         return -1;

-- 
Libav/FFmpeg packaging