- int16_t *output = data, *end;
- int i, num_samples;
-
- num_samples = s->frame_size * avctx->channels;
- end = output + *data_size / sizeof(*output);
-
- speex_bits_read_from(&s->bits, buf, buf_size);
-
- for (i = 0; speex_bits_remaining(&s->bits) && output + num_samples < end; i++) {
- int ret = speex_decode_int(s->dec_state, &s->bits, output);
- if (ret <= -2) {
- av_log(avctx, AV_LOG_ERROR, "Error decoding Speex frame.\n");
- return -1;
- } else if (ret == -1)
- // end of stream
- break;
+ int16_t *output = data;
+ int out_size, ret, consumed = 0;
+
+ /* check output buffer size */
+ out_size = s->frame_size * avctx->channels *
+ av_get_bytes_per_sample(avctx->sample_fmt);
+ if (*data_size < out_size) {
+ av_log(avctx, AV_LOG_ERROR, "Output buffer is too small\n");
+ return AVERROR(EINVAL);
+ }