diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 03:33:06 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 03:34:01 +0100 |
| commit | 66ff90f4a3d81c25feaa672dc8cc9cc88017753d (patch) | |
| tree | 59bea903dcd2890fd712c239eb4add8cabf46fb0 | |
| parent | 7acee6654ccdbadea62e700970f789478febaa0c (diff) | |
| download | ffmpeg-66ff90f4a3d81c25feaa672dc8cc9cc88017753d.tar.gz | |
8bps: check index against buffer size before reading line length pointer.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/8bps.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/8bps.c b/libavcodec/8bps.c index a6d0a1b92e..f895ed39a8 100644 --- a/libavcodec/8bps.c +++ b/libavcodec/8bps.c @@ -98,6 +98,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, for (row = 0; row < height; row++) { pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; pixptr_end = pixptr + c->pic.linesize[0]; + if(lp - encoded + row*2 + 1 >= buf_size) + return -1; dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2)); /* Decode a row of this plane */ while (dlen > 0) { |