diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-06-13 14:10:06 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-13 14:10:06 +0200 |
| commit | 27e8298c037587d88a3bda1c97caf2351e2e3243 (patch) | |
| tree | cc0f76ed014a5f117de6430c2affc83d34fd7888 | |
| parent | 67d5d97cdcd7ada748320edf34453d94668a67c6 (diff) | |
| parent | 94aefb1932be882fd93f66cf790ceb19ff575c19 (diff) | |
| download | ffmpeg-27e8298c037587d88a3bda1c97caf2351e2e3243.tar.gz | |
Merge commit '94aefb1932be882fd93f66cf790ceb19ff575c19'
* commit '94aefb1932be882fd93f66cf790ceb19ff575c19':
4xm: do not overread the source buffer in decode_p_block
Conflicts:
libavcodec/4xm.c
The checks are replaced by av_assert0() as the conditions should
be impossible. If these asserts fail, there is a bug elsewhere
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/4xm.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index bb380f6779..dc0ad506d5 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -375,6 +375,7 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, log2w, log2h, stride)) < 0) return ret; } else if (code == 3 && f->version < 2) { + av_assert0(start <= src && src <= end); mcdc(dst, src, log2w, h, stride, 1, 0); } else if (code == 4) { if (bytestream2_get_bytes_left(&f->g) < 1) { @@ -396,6 +397,7 @@ static int decode_p_block(FourXContext *f, uint16_t *dst, uint16_t *src, av_log(f->avctx, AV_LOG_ERROR, "wordstream overread\n"); return AVERROR_INVALIDDATA; } + av_assert0(start <= src && src <= end); mcdc(dst, src, log2w, h, stride, 0, bytestream2_get_le16u(&f->g2)); } else if (code == 6) { if (bytestream2_get_bytes_left(&f->g2) < 4) { |