check data_size in decode_frame()

Originally committed as revision 19986 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mpegaudiodec.c b/libavcodec/mpegaudiodec.c
index 2ba47df..6f451c3 100644 (file)
--- a/libavcodec/mpegaudiodec.c
+++ b/libavcodec/mpegaudiodec.c
@@ -2276,6 +2276,9 @@ static int decode_frame(AVCodecContext * avctx,
     avctx->bit_rate = s->bit_rate;
     avctx->sub_id = s->layer;
 
+    if(*data_size < 1152*avctx->channels*sizeof(OUT_INT))
+        return -1;
+
     if(s->frame_size<=0 || s->frame_size > buf_size){
         av_log(avctx, AV_LOG_ERROR, "incomplete frame\n");
         return -1;