diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-04 00:50:19 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-04 01:00:19 +0100 |
| commit | c13e73c25b6d548c6982cfe267b3925dad4f253e (patch) | |
| tree | 542b802d85eef8b1df8ad5063822a346ce884ba7 | |
| parent | 3cf1503beb35203ef4b9ddef5a2bc8b6f919eb12 (diff) | |
| parent | 5569146d48f06564e8fa393424782cceed510916 (diff) | |
| download | ffmpeg-c13e73c25b6d548c6982cfe267b3925dad4f253e.tar.gz | |
Merge commit '5569146d48f06564e8fa393424782cceed510916'
* commit '5569146d48f06564e8fa393424782cceed510916':
adx: check that the offset is not negative
See: 30bce34b6719ca99ad72c62e2fba3eade71f1eae
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/adx.c | 7 |
1 files changed, 1 insertions, 6 deletions
diff --git a/libavcodec/adx.c b/libavcodec/adx.c index 94bc386dab..30e13c0c1c 100644 --- a/libavcodec/adx.c +++ b/libavcodec/adx.c @@ -47,13 +47,8 @@ int avpriv_adx_decode_header(AVCodecContext *avctx, const uint8_t *buf, return AVERROR_INVALIDDATA; offset = AV_RB16(buf + 2) + 4; - if (offset < 6) { - av_log(avctx, AV_LOG_ERROR, "offset is prior data\n"); - return AVERROR_INVALIDDATA; - } - /* if copyright string is within the provided data, validate it */ - if (bufsize >= offset && memcmp(buf + offset - 6, "(c)CRI", 6)) + if (bufsize >= offset && offset >= 6 && memcmp(buf + offset - 6, "(c)CRI", 6)) return AVERROR_INVALIDDATA; /* check for encoding=3 block_size=18, sample_size=4 */ |