diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-25 00:08:51 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-01 20:25:21 +0200 |
| commit | 1b26a734b23829f0756500f9cec2ac47baa65cd7 (patch) | |
| tree | da79df20f69b6a2cc08c4c7d37d9ff01985ca310 | |
| parent | 02bdeff1ef4915e1794a19184d567ef27e05c9c5 (diff) | |
| download | ffmpeg-1b26a734b23829f0756500f9cec2ac47baa65cd7.tar.gz | |
Fix potential pointer arithmetic overflows in rle_unpack() of vmd video decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 35cb6854bb76b4a5b6f2aea2dce81e18d7ab61cd)
| -rw-r--r-- | libavcodec/vmdav.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index 90cbab8b3d..1f9694ea29 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -179,13 +179,13 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, l = *ps++; if (l & 0x80) { l = (l & 0x7F) * 2; - if (pd + l > dest_end || ps_end - ps < l) + if (dest_end - pd < l || ps_end - ps < l) return ps - src; memcpy(pd, ps, l); ps += l; pd += l; } else { - if (pd + i > dest_end || ps_end - ps < 2) + if (dest_end - pd < i || ps_end - ps < 2) return ps - src; for (i = 0; i < l; i++) { *pd++ = ps[0]; |