diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 23:48:58 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 23:52:08 +0100 |
| commit | ffe31c654d0e7218ca36fb7884bac35736e232bb (patch) | |
| tree | 6a88fcabfc202b86782ebc05e369337a9b16adf5 | |
| parent | 5c4aa72b75c1715d031df38d925445698be67de4 (diff) | |
| download | ffmpeg-ffe31c654d0e7218ca36fb7884bac35736e232bb.tar.gz | |
avcodec/hnm4video: check writeoffset in decode_interframe_v4a()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/hnm4video.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index f394032288..742b1d3346 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -287,6 +287,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src, if (tag == 0) { writeoffset += bytestream2_get_byte(&gb); } else if (tag == 1) { + if (writeoffset + hnm->width >= hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } hnm->current[writeoffset] = bytestream2_get_byte(&gb); hnm->current[writeoffset + hnm->width] = bytestream2_get_byte(&gb); writeoffset++; @@ -295,6 +299,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src, } else if (tag == 3) { break; } + if (writeoffset > hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } } else { delta = bytestream2_peek_byte(&gb) & 0x80; previous = bytestream2_peek_byte(&gb) & 0x40; |