diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-19 22:48:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-21 21:04:51 +0200 |
| commit | d2c5904cab95cf064bbe885660eb2af0eaa89714 (patch) | |
| tree | 6624c8a9355f79b1cfa81d48ea4c2aabebff8030 | |
| parent | 3899b3be0c4db1c280ed98e01388f8cebb888ef9 (diff) | |
| download | ffmpeg-d2c5904cab95cf064bbe885660eb2af0eaa89714.tar.gz | |
Check for invalid slice offsets in real decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8716c178ddabe28a01a9fe81fff68d117b779333)
| -rw-r--r-- | libavcodec/rv34.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 9196c9558d..1810263751 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1452,8 +1452,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, slice_count = avctx->slice_count; //parse first slice header to check whether this frame can be decoded - if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){ - av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); + if(get_slice_offset(avctx, slices_hdr, 0) < 0 || + get_slice_offset(avctx, slices_hdr, 0) > buf_size){ + av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); return -1; } init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8); @@ -1476,8 +1477,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, else size= get_slice_offset(avctx, slices_hdr, i+1) - offset; - if(offset > buf_size){ - av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); + if(offset < 0 || offset > buf_size || size < 0){ + av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); break; } |