aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-08-07 15:50:26 +0200
committerMichael Niedermayer <michaelni@gmx.at>2013-08-11 00:14:17 +0200
commitacf511de34e0b79fff0183e06ed37f1aa8dc3d94 (patch)
treede141e188a86249b93af7ebc42281b381baa592d
parentfd2951bb53b3096a90307945fa074da9f9980d55 (diff)
downloadffmpeg-acf511de34e0b79fff0183e06ed37f1aa8dc3d94.tar.gz
avcodec/g2meet: fix src pointer checks in kempf_decode_tile()n2.0.1
Fixes Ticket2842 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 2960576378d17d71cc8dccc926352ce568b5eec1) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/g2meet.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index bc01dfafc8..d31fc54ca8 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -389,7 +389,7 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
return 0;
zsize = (src[0] << 8) | src[1]; src += 2;
- if (src_end - src < zsize)
+ if (src_end - src < zsize + (sub_type != 2))
return AVERROR_INVALIDDATA;
ret = uncompress(c->kempf_buf, &dlen, src, zsize);
@@ -411,6 +411,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {
for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {
if (!bits) {
+ if (src >= src_end)
+ return AVERROR_INVALIDDATA;
bitbuf = *src++;
bits = 8;
}