Hi,

On 04/28/2011 02:08 PM, Diego Biurrun wrote:

> +    if (*data_size < 4 * buf_size * 8 / (avctx->bits_per_coded_sample + 4))
> +        return -1;


I think this can cause invalid writes if buf_size > INT_MAX/32

-Justin
_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel

Reply via email to