aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-06-20 03:15:28 +0200
committerMichael Niedermayer <michaelni@gmx.at>2014-06-23 15:23:08 +0200
commit24a0273cb86ec0b8bf17c71e7f426c3aa9e4989f (patch)
treef00c46551d2ddca130e1cd7c80af85881c1085cc
parent974c2ad87c348a0116a40758ab47ecf2c8d132d2 (diff)
downloadffmpeg-24a0273cb86ec0b8bf17c71e7f426c3aa9e4989f.tar.gz
avutil/lzo: Fix integer overflow
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list) Fixes: LMS-2014-06-16-4 Found-by: "Don A. Bailey" <donb@securitymouse.com> See: ccda51b14c0fcae2fad73a24872dce75a7964996 Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit d6af26c55c1ea30f85a7d9edbc373f53be1743ee) Conflicts: libavutil/lzo.c (cherry picked from commit 7b5c706494a775b2b0d0e0a38448610802eef8f4) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavutil/lzo.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index 8cb26370ec..e284fa8f26 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -62,7 +62,13 @@ static inline int get_byte(LZOContext *c) {
static inline int get_len(LZOContext *c, int x, int mask) {
int cnt = x & mask;
if (!cnt) {
- while (!(x = get_byte(c))) cnt += 255;
+ while (!(x = get_byte(c))) {
+ if (cnt >= INT_MAX - 1000) {
+ c->error |= AV_LZO_ERROR;
+ break;
+ }
+ cnt += 255;
+ }
cnt += mask + x;
}
return cnt;