diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-02 02:15:03 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 00:45:07 +0100 |
| commit | 271f5d68b922174e5b49df9778c89ee76b105c60 (patch) | |
| tree | fef883f87bbf2cd10eef0c2f0c5d153d7321c378 | |
| parent | dee327b0e70d7051ed0d349974e88bd1ec8a246c (diff) | |
| download | ffmpeg-271f5d68b922174e5b49df9778c89ee76b105c60.tar.gz | |
avcodec/ansi: Check x/y
This prevents out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e91fd754c63de7fd3cb7fdea8974166db362e387)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/ansi.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/ansi.c b/libavcodec/ansi.c index 51339d24f9..655c86970c 100644 --- a/libavcodec/ansi.c +++ b/libavcodec/ansi.c @@ -239,6 +239,8 @@ static int execute_code(AVCodecContext * avctx, int c) default: av_log_ask_for_sample(avctx, "unsupported screen mode\n"); } + s->x = av_clip(s->x, 0, width - FONT_WIDTH); + s->y = av_clip(s->y, 0, height - s->font_height); if (width != avctx->width || height != avctx->height) { if (s->frame.data[0]) avctx->release_buffer(avctx, &s->frame); @@ -335,6 +337,8 @@ static int execute_code(AVCodecContext * avctx, int c) av_log_ask_for_sample(avctx, "unsupported escape code\n"); break; } + s->x = av_clip(s->x, 0, avctx->width - FONT_WIDTH); + s->y = av_clip(s->y, 0, avctx->height - s->font_height); return 0; } |