diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-01 23:46:38 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-13 00:44:44 +0200 |
| commit | e9d9fd1137b18c5649342a15c77f67d1c5d0be01 (patch) | |
| tree | 9c43808be6fd350fc64231334dc6fffd4875c6c1 | |
| parent | e4bae0a140677869ffad76fd742d6f4ecbd57b2c (diff) | |
| download | ffmpeg-e9d9fd1137b18c5649342a15c77f67d1c5d0be01.tar.gz | |
vmdav: Try to fix unpack_rle()
This fixes out of array accesses
The code prior to this commit could not have worked, thus obviously
was untested. I was also not able to find a valid sample that uses this
code.
This fix is thus only based on the description of the format
If someone has a sample that uses unpack_rle(), please mail me.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c1f2c4c3b49277d65b71ccdd3b6b2878f1b593eb)
Conflicts:
libavcodec/vmdav.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 0baa0a5a02e16ef097ed9f72bc8a7d7b585c7652)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vmdav.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index 9c96055b62..c50117c44e 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -162,7 +162,7 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, const unsigned char *ps; const unsigned char *ps_end; unsigned char *pd; - int i, l; + int i, j, l; unsigned char *dest_end = dest + dest_len; ps = src; @@ -188,9 +188,9 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, ps += l; pd += l; } else { - if (dest_end - pd < i || ps_end - ps < 2) + if (dest_end - pd < 2*l || ps_end - ps < 2) return ps - src; - for (i = 0; i < l; i++) { + for (j = 0; j < l; j++) { *pd++ = ps[0]; *pd++ = ps[1]; } |