diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-07 21:04:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-14 01:30:16 +0200 |
| commit | 2c66058737e254756118b7f7be0be7d3bfbb4fe3 (patch) | |
| tree | 48b11973cfcddd10bce58701a5aaa0b07d8f1258 | |
| parent | 813b3d11e0286b1d656633cd5717f3f43db5d1ac (diff) | |
| download | ffmpeg-2c66058737e254756118b7f7be0be7d3bfbb4fe3.tar.gz | |
avcodec/cdgraphics: check buffer size before use
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13a8df934bd6cb2c84175a4780ab8942)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index 8638dca931..72e569f10c 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -295,7 +295,9 @@ static int cdg_decode_frame(AVCodecContext *avctx, inst = bytestream_get_byte(&buf); inst &= CDG_MASK; buf += 2; /// skipping 2 unneeded bytes - bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); + + if (buf_size > CDG_HEADER_SIZE) + bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); if ((command & CDG_MASK) == CDG_COMMAND) { switch (inst) { |