diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 16:50:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-09 21:34:34 +0200 |
| commit | 42bdeaecd41cb99f80901ce1a9649a9cb2b639b6 (patch) | |
| tree | facb48ebe8f1ef57209ea163ad4909b62b288a70 | |
| parent | 438cfa9090a3330b609e4435a55fc8af1d193de7 (diff) | |
| download | ffmpeg-42bdeaecd41cb99f80901ce1a9649a9cb2b639b6.tar.gz | |
cdgraphics: Fix out of array write
Fixes Ticket1359
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e5c7376c4ed733910845c9a09e272ac7696b1f4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index c174aa9d98..8d8aea437d 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n"); return AVERROR(EINVAL); } + if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) { + av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n"); + return AVERROR(EINVAL); + } ret = avctx->reget_buffer(avctx, &cc->frame); if (ret) { |