Check *data_size in decode_frame()

Originally committed as revision 14636 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/ra288.c b/libavcodec/ra288.c
index f6476c1..353ae52 100644 (file)
--- a/libavcodec/ra288.c
+++ b/libavcodec/ra288.c
@@ -236,6 +236,9 @@ static int ra288_decode_frame(AVCodecContext * avctx, void *data,
         return 0;
     }
 
+    if (*data_size < 32*5*2)
+        return -1;
+
     init_get_bits(&gb, buf, avctx->block_align * 8);
 
     for (i=0; i < 32; i++) {