1 files changed, 9 insertions, 1 deletions
diff --git a/contrib/ffmpeg/libavcodec/ws-snd1.c b/contrib/ffmpeg/libavcodec/ws-snd1.c
index 3624909a3..057d4bfc2 100644
--- a/contrib/ffmpeg/libavcodec/ws-snd1.c
+++ b/contrib/ffmpeg/libavcodec/ws-snd1.c
@@ -45,7 +45,7 @@ static int ws_snd_decode_init(AVCodecContext * avctx)
 
 static int ws_snd_decode_frame(AVCodecContext *avctx,
                 void *data, int *data_size,
-                uint8_t *buf, int buf_size)
+                const uint8_t *buf, int buf_size)
 {
 //    WSSNDContext *c = avctx->priv_data;
 
@@ -62,6 +62,14 @@ static int ws_snd_decode_frame(AVCodecContext *avctx,
     in_size = AV_RL16(&buf[2]);
     buf += 4;
 
+    if (out_size > *data_size) {
+        av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n");
+        return -1;
+    }
+    if (in_size > buf_size) {
+        av_log(avctx, AV_LOG_ERROR, "Frame data is larger than input buffer\n");
+        return -1;
+    }
     if (in_size == out_size) {
         for (i = 0; i < out_size; i++)
             *samples++ = (*buf++ - 0x80) << 8;