@@ -185,7 +185,7 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
{
LAMEContext *s = avctx->priv_data;
MPADecodeHeader hdr;
- int len, ret, ch;
+ int len, ret, ch, discard_padding;
int lame_result;
uint32_t h;
@@ -269,6 +269,25 @@ static int mp3lame_encode_frame(AVCodecContext *avctx, AVPacket *avpkt,
ff_af_queue_remove(&s->afq, avctx->frame_size, &avpkt->pts,
&avpkt->duration);
+ discard_padding = avctx->frame_size - avpkt->duration;
+ // Check if subtraction resulted in an overflow
+ if ((discard_padding < avctx->frame_size) != (avpkt->duration > 0)) {
+ av_packet_unref(avpkt);
+ av_free(avpkt);
+ return AVERROR(EINVAL);
+ }
+ if (discard_padding > 0) {
+ uint8_t* side_data = av_packet_new_side_data(avpkt,
+ AV_PKT_DATA_SKIP_SAMPLES,
+ 10);
+ if(!side_data) {
+ av_packet_unref(avpkt);
+ av_free(avpkt);
+ return AVERROR(ENOMEM);
+ }
+ AV_WL32(side_data + 4, discard_padding);
+ }
+
avpkt->size = len;
*got_packet_ptr = 1;
}