diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-09 18:40:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-09 18:44:01 +0100 |
| commit | b5fc95e77f9e154978d914548b86a8bc9fd1d0f2 (patch) | |
| tree | a715a63f144458dc4e3757efe7a5c4fb28ee46c7 | |
| parent | 4401958fdc9abd3551dd1903bd6d30890329b448 (diff) | |
| download | ffmpeg-b5fc95e77f9e154978d914548b86a8bc9fd1d0f2.tar.gz | |
motionpixels: Check that the vlc table has been fully inited
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/motionpixels.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/motionpixels.c b/libavcodec/motionpixels.c index f69cd569e2..4fa45e9c5d 100644 --- a/libavcodec/motionpixels.c +++ b/libavcodec/motionpixels.c @@ -137,6 +137,10 @@ static int mp_read_codes_table(MotionPixelsContext *mp, GetBitContext *gb) mp->current_codes_count = 0; if ((ret = mp_get_code(mp, gb, 0, 0)) < 0) return ret; + if (mp->current_codes_count < mp->codes_count) { + av_log(mp->avctx, AV_LOG_ERROR, "too few codes\n"); + return AVERROR_INVALIDDATA; + } } return 0; } |