diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-20 18:08:18 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-08 15:32:44 +0100 |
| commit | c598a46821f001fe73b69a59432716ad84e68cf5 (patch) | |
| tree | 225c7f5653caf6460d50a7c4ad01e08ac9b07b19 | |
| parent | 912b7fe922bcc12c9a953371c304ac39a0629df2 (diff) | |
| download | ffmpeg-c598a46821f001fe73b69a59432716ad84e68cf5.tar.gz | |
avcodec/vmnc: Check that rectangles are within the picture
Prevents out of array accesses with CODEC_FLAG_EMU_EDGE
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6ba02602aa7fc7d38db582e75b8b093fb3c1608d)
Conflicts:
libavcodec/vmnc.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 7c17207ab9acfaa934e8feb8fba90765c9d0b989)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vmnc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vmnc.c b/libavcodec/vmnc.c index 5eb8372ed3..4e58d59510 100644 --- a/libavcodec/vmnc.c +++ b/libavcodec/vmnc.c @@ -275,6 +275,11 @@ static int decode_hextile(VmncContext *c, uint8_t* dst, const uint8_t* src, int } xy = *src++; wh = *src++; + if ( (xy >> 4) + (wh >> 4) + 1 > w - i + || (xy & 0xF) + (wh & 0xF)+1 > h - j) { + av_log(c->avctx, AV_LOG_ERROR, "Rectangle outside picture\n"); + return AVERROR_INVALIDDATA; + } paint_rect(dst2, xy >> 4, xy & 0xF, (wh>>4)+1, (wh & 0xF)+1, fg, bpp, stride); } } |