[Swfdec-commits] Branch '0.8' - swfdec/swfdec_audio_decoder_uncompressed.c

[Benjamin Otte]

 swfdec/swfdec_audio_decoder_uncompressed.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

New commits:
commit 20d82d0bfb234c4886c6648fb352cc9bc2445f17
Author: Benjamin Otte <otte at gnome.org>
Date:   Mon Oct 13 15:24:02 2008 +0200

    fix invalid write when reading unaligned data (fixes #18029)

diff --git a/swfdec/swfdec_audio_decoder_uncompressed.c b/swfdec/swfdec_audio_decoder_uncompressed.c
index 69a6922..5371d9f 100644
--- a/swfdec/swfdec_audio_decoder_uncompressed.c
+++ b/swfdec/swfdec_audio_decoder_uncompressed.c
@@ -99,10 +99,13 @@ swfdec_audio_decoder_uncompressed_decode_16bit (SwfdecBuffer *buffer)
   gint16 *src, *dest;
   guint i;
 
-  ret = swfdec_buffer_new (buffer->length);
+  if (buffer->length & 2) {
+    SWFDEC_ERROR ("buffer length not a multiple of 16bit");
+  }
+  ret = swfdec_buffer_new (buffer->length & ~1);
   src = (gint16 *) buffer->data;
   dest = (gint16 *) ret->data;
-  for (i = 0; i < buffer->length; i += 2) {
+  for (i = 0; i < ret->length; i += 2) {
     *dest = GINT16_FROM_LE (*src);
     dest++;
     src++;