diff options
| author | Xi Wang <xi.wang@gmail.com> | 2013-03-15 06:59:22 -0400 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-09 11:29:05 +0200 |
| commit | 530d10792de29a25dc56781abe6864e5b31b8ced (patch) | |
| tree | e3980a2360cdb3e854c1ae345777df4f4b98b3ea | |
| parent | f8d3bb8961d2cdea38ae2971436deae556d78f08 (diff) | |
| download | ffmpeg-530d10792de29a25dc56781abe6864e5b31b8ced.tar.gz | |
lzo: fix overflow checking in copy_backptr()
The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.
Remove the check. Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit ca6c3f2c53be70aa3c38e8f1292809db89ea1ba6)
Conflicts:
libavutil/lzo.c
| -rw-r--r-- | libavutil/lzo.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/libavutil/lzo.c b/libavutil/lzo.c index ef01653aa8..9cc82dce91 100644 --- a/libavutil/lzo.c +++ b/libavutil/lzo.c @@ -119,9 +119,8 @@ static inline void memcpy_backptr(uint8_t *dst, int back, int cnt); * thus creating a repeating pattern with a period length of back. */ static inline void copy_backptr(LZOContext *c, int back, int cnt) { - register const uint8_t *src = &c->out[-back]; register uint8_t *dst = c->out; - if (src < c->out_start || src > dst) { + if (dst - c->out_start < back) { c->error |= AV_LZO_INVALID_BACKPTR; return; } |