aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2015-02-25 12:29:10 +0100
committerMichael Niedermayer <michaelni@gmx.at>2015-03-12 18:03:50 +0100
commit0c1f8a784db9d60f30f838153f03e325437ec844 (patch)
tree2ffc97dc397a3b905ac9ea58469b70a0550d01d2
parent07a9a43d5c1f6c4abcaba38d1e398aea6ad23802 (diff)
downloadffmpeg-0c1f8a784db9d60f30f838153f03e325437ec844.tar.gz
avcodec/zmbv: Check len before reading in decode_frame()
Fixes out of array read Fixes: asan_heap-oob_4d4eb0_3994_cov_3169972261_zmbv_15bit.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 1f5c7781e63d6519192ada59c1e36bcecc92791d) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/zmbv.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c
index 38ab7253f1..1ac7274016 100644
--- a/libavcodec/zmbv.c
+++ b/libavcodec/zmbv.c
@@ -416,11 +416,16 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
}
/* parse header */
+ if (len < 1)
+ return AVERROR_INVALIDDATA;
c->flags = buf[0];
buf++; len--;
if (c->flags & ZMBV_KEYFRAME) {
void *decode_intra = NULL;
c->decode_intra= NULL;
+
+ if (len < 6)
+ return AVERROR_INVALIDDATA;
hi_ver = buf[0];
lo_ver = buf[1];
c->comp = buf[2];