diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-06-20 03:15:28 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-06-23 15:21:18 +0200 |
| commit | 6a968073daa74ffb98368fefd476a4562ce84e1b (patch) | |
| tree | f0e3525e756d269c82420faeec74a38811b7e844 | |
| parent | c1ac5896ef9a37fb2e198b7de36e477a9f1a69e9 (diff) | |
| download | ffmpeg-6a968073daa74ffb98368fefd476a4562ce84e1b.tar.gz | |
avutil/lzo: Fix integer overflow
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)
Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb@securitymouse.com>
See: ccda51b14c0fcae2fad73a24872dce75a7964996
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d6af26c55c1ea30f85a7d9edbc373f53be1743ee)
Conflicts:
libavutil/lzo.c
(cherry picked from commit 7b5c706494a775b2b0d0e0a38448610802eef8f4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavutil/lzo.c | 8 |
1 files changed, 7 insertions, 1 deletions
diff --git a/libavutil/lzo.c b/libavutil/lzo.c index 8cb8da43a3..58878bce16 100644 --- a/libavutil/lzo.c +++ b/libavutil/lzo.c @@ -62,7 +62,13 @@ static inline int get_byte(LZOContext *c) { static inline int get_len(LZOContext *c, int x, int mask) { int cnt = x & mask; if (!cnt) { - while (!(x = get_byte(c))) cnt += 255; + while (!(x = get_byte(c))) { + if (cnt >= INT_MAX - 1000) { + c->error |= AV_LZO_ERROR; + break; + } + cnt += 255; + } cnt += mask + x; } return cnt; |