diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-14 18:28:31 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-14 18:54:10 +0200 |
| commit | 83c7803f55b3231faeb93c1a634399a70fae9480 (patch) | |
| tree | dd4a4246e0a53974adfb12035090ae592fe718a0 | |
| parent | 56dcfe87ef173f875ca927fa4d2140f090d09336 (diff) | |
| download | ffmpeg-83c7803f55b3231faeb93c1a634399a70fae9480.tar.gz | |
lagarith: check count before writing zeros.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/lagarith.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c index 22d427e159..7f47b75826 100644 --- a/libavcodec/lagarith.c +++ b/libavcodec/lagarith.c @@ -326,6 +326,10 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst, output_zeros: if (l->zeros_rem) { count = FFMIN(l->zeros_rem, width - i); + if(end - dst < count) { + av_log(l->avctx, AV_LOG_ERROR, "too many zeros remaining\n"); + return AVERROR_INVALIDDATA; + } memset(dst, 0, count); l->zeros_rem -= count; dst += count; |