diff options
| author | Paul B Mahol <onemda@gmail.com> | 2013-07-26 21:53:54 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-08-10 02:03:37 +0200 |
| commit | 80fb38153e7d8c526ee2dce09c0d685bf5220ef1 (patch) | |
| tree | 45861eb9557afe6d5a997c508049d9b0779eadc0 | |
| parent | b79f337f8a683887f8bb436812c8bee3fd67f95e (diff) | |
| download | ffmpeg-80fb38153e7d8c526ee2dce09c0d685bf5220ef1.tar.gz | |
sgidec: safer check for buffer overflow
Signed-off-by: Paul B Mahol <onemda@gmail.com>
(cherry picked from commit 86e722ab97d7f5f0552c8a0958f7910dfcf3c5b7)
Conflicts:
libavcodec/sgidec.c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/sgidec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/sgidec.c b/libavcodec/sgidec.c index e7f453bc17..84e39ef1f4 100644 --- a/libavcodec/sgidec.c +++ b/libavcodec/sgidec.c @@ -58,7 +58,8 @@ static int expand_rle_row(SgiState *s, uint8_t *out_buf, } /* Check for buffer overflow. */ - if(out_buf + pixelstride * (count-1) >= out_end) return -1; + if (out_end - out_buf <= pixelstride * (count - 1)) + return -1; if (pixel & 0x80) { while (count--) { |