diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-03-27 18:18:38 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-04-06 11:47:56 +0200 |
| commit | 62f9253781fa4534f10f8dbb0a2fea9377a8c87e (patch) | |
| tree | a30228605077bf1eb804c074ac1566d7222de1b4 | |
| parent | 858864d350320dd807e349bda017026e61a47fe0 (diff) | |
| download | ffmpeg-62f9253781fa4534f10f8dbb0a2fea9377a8c87e.tar.gz | |
dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/dfa.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index 119be7066c..332a53ee77 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -257,6 +257,8 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height segments = bytestream2_get_le16(gb); } line_ptr = frame; + if (frame_end - frame < width) + return AVERROR_INVALIDDATA; frame += width; y++; while (segments--) { |