diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-08-09 19:20:39 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-08-09 19:29:48 +0200 |
| commit | 5404bf29c3b720ef04314c50b18047a94e4534b6 (patch) | |
| tree | c0d667da93118449dcd87702058800552468933b | |
| parent | 2c10833d5e4c055033eb89c0e10484919fe251a5 (diff) | |
| parent | a465ed5707f5cbc9713d5e9629d424cd2d46e038 (diff) | |
| download | ffmpeg-5404bf29c3b720ef04314c50b18047a94e4534b6.tar.gz | |
Merge commit 'a465ed5707f5cbc9713d5e9629d424cd2d46e038' into release/0.10
* commit 'a465ed5707f5cbc9713d5e9629d424cd2d46e038':
pgssubdec: Check RLE size before copying
Merged-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/pgssubdec.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/pgssubdec.c b/libavcodec/pgssubdec.c index 2785d25914..fd84af5596 100644 --- a/libavcodec/pgssubdec.c +++ b/libavcodec/pgssubdec.c @@ -207,6 +207,13 @@ static int parse_picture_segment(AVCodecContext *avctx, /* Decode rle bitmap length, stored size includes width/height data */ rle_bitmap_len = bytestream_get_be24(&buf) - 2*2; + if (buf_size > rle_bitmap_len) { + av_log(avctx, AV_LOG_ERROR, + "Buffer dimension %d larger than the expected RLE data %d\n", + buf_size, rle_bitmap_len); + return AVERROR_INVALIDDATA; + } + /* Get bitmap dimensions from data */ width = bytestream_get_be16(&buf); height = bytestream_get_be16(&buf); |