diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-07 21:04:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-13 00:45:21 +0200 |
| commit | 151c2ca8c797a00927776bb77427dc0c77e641d2 (patch) | |
| tree | 2e403af47e3659975518296b323e24f89337b79b | |
| parent | dafd8228bc0f7d9a6afd4e84a476b3a73e0a5a4b (diff) | |
| download | ffmpeg-151c2ca8c797a00927776bb77427dc0c77e641d2.tar.gz | |
avcodec/cdgraphics: check buffer size before use
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13a8df934bd6cb2c84175a4780ab8942)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index 71d9da7ee2..218d68a11c 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -296,7 +296,9 @@ static int cdg_decode_frame(AVCodecContext *avctx, inst = bytestream_get_byte(&buf); inst &= CDG_MASK; buf += 2; /// skipping 2 unneeded bytes - bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); + + if (buf_size > CDG_HEADER_SIZE) + bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); if ((command & CDG_MASK) == CDG_COMMAND) { switch (inst) { |