diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2008-07-13 20:03:57 +0000 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2008-07-13 20:03:57 +0000 |
| commit | b08edb22684c1848b1c6186848585c324d9aae62 (patch) | |
| tree | b4950951909208b8e82f365f665753a5075e5794 | |
| parent | 4138ad961c4d577d32beb930155558d05bd2cfd3 (diff) | |
| download | ffmpeg-b08edb22684c1848b1c6186848585c324d9aae62.tar.gz | |
check that csize in ff_lzw_decode_init is < LZW_MAXBITS, <= is not enough and
might read outside the prefix array
Originally committed as revision 14214 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/lzw.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c index 207b807e9d..7bdc89a37c 100644 --- a/libavcodec/lzw.c +++ b/libavcodec/lzw.c @@ -131,7 +131,7 @@ int ff_lzw_decode_init(LZWState *p, int csize, const uint8_t *buf, int buf_size, { struct LZWState *s = (struct LZWState *)p; - if(csize < 1 || csize > LZW_MAXBITS) + if(csize < 1 || csize >= LZW_MAXBITS) return -1; /* read buffer */ s->pbuf = buf; |