diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-07-11 14:48:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-07-11 14:48:57 +0200 |
| commit | a2550e7d2e4c1e2f1fd262985a1d789240f7e839 (patch) | |
| tree | 7e46f9c1d8262698f1ff3303be2c537ed0908316 | |
| parent | 9585c50942a4364d896e64b58541693879e4989f (diff) | |
| download | ffmpeg-a2550e7d2e4c1e2f1fd262985a1d789240f7e839.tar.gz | |
avcodec/iff: Check that there are enough bytes in dgb before reading
Fixes CID1361959
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/iff.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/iff.c b/libavcodec/iff.c index 141acc7f92..676d06288a 100644 --- a/libavcodec/iff.c +++ b/libavcodec/iff.c @@ -1388,6 +1388,8 @@ static void decode_delta_l(uint8_t *dst, offset = ((2 * offset) / planepitch_byte) * pitch + ((2 * offset) % planepitch_byte) + k * planepitch; if (cnt < 0) { + if (bytestream2_get_bytes_left(&dgb) < 2) + break; bytestream2_seek_p(&pb, offset, SEEK_SET); cnt = -cnt; data = bytestream2_get_be16(&dgb); @@ -1396,6 +1398,8 @@ static void decode_delta_l(uint8_t *dst, bytestream2_skip_p(&pb, dstpitch - 2); } } else { + if (bytestream2_get_bytes_left(&dgb) < 2*cnt) + break; bytestream2_seek_p(&pb, offset, SEEK_SET); for (i = 0; i < cnt; i++) { data = bytestream2_get_be16(&dgb); |