diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-01 23:46:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-14 01:29:16 +0200 |
| commit | d814b9b51ddd3764e809c1d0f82b770e0bc085fd (patch) | |
| tree | 91a4fa8864ccc9474643ba8dc3c1ceb67b1f56ee | |
| parent | 1d285db8a3a85fb5eadd28640eb121684d7f6463 (diff) | |
| download | ffmpeg-d814b9b51ddd3764e809c1d0f82b770e0bc085fd.tar.gz | |
vmdav: Try to fix unpack_rle()
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b49277d65b71ccdd3b6b2878f1b593eb)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02e16ef097ed9f72bc8a7d7b585c7652)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vmdav.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index 3834416857..b838781345 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -160,7 +160,7 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, const unsigned char *ps; const unsigned char *ps_end; unsigned char *pd; - int i, l; + int i, j, l; unsigned char *dest_end = dest + dest_len; ps = src; @@ -186,9 +186,9 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, ps += l; pd += l; } else { - if (dest_end - pd < i || ps_end - ps < 2) + if (dest_end - pd < 2*l || ps_end - ps < 2) return ps - src; - for (i = 0; i < l; i++) { + for (j = 0; j < l; j++) { *pd++ = ps[0]; *pd++ = ps[1]; } |