diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-26 21:53:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-08 00:23:35 +0100 |
| commit | 413065aff4efdc895ec2b4f5e9beedcc6b07376d (patch) | |
| tree | c6c248a4e23ee2ca69782b6ed8e09e34ed0271ea | |
| parent | c094aec76e291dccf46239a2e221f16d695452d1 (diff) | |
| download | ffmpeg-413065aff4efdc895ec2b4f5e9beedcc6b07376d.tar.gz | |
avcodec/g2meet: check available space before copying palette
Fixes out of array read
Fixes: asan_heap-uaf_ae6067_5415_g2m4.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 6d9dad6a7cb5d544d540abf941fedbd34c14d2bd)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/g2meet.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index b342ae7262..452cd7c7bb 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -375,6 +375,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y, src += 3; } npal = *src++ + 1; + if (src_end - src < npal * 3) + return AVERROR_INVALIDDATA; memcpy(pal, src, npal * 3); src += npal * 3; if (sub_type != 2) { for (i = 0; i < npal; i++) { |