diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-27 23:43:51 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-10-01 20:44:25 +0200 |
| commit | 70727e16ca6840873145332bc16c0cfab1a3cdd5 (patch) | |
| tree | 08978264d3060288a2577c5271cfebb013758a4d | |
| parent | 08decaeb95f20821df993a7c3b1692ce654ad390 (diff) | |
| download | ffmpeg-70727e16ca6840873145332bc16c0cfab1a3cdd5.tar.gz | |
Check for out of bound writes in the wmavoice decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e09ae22ab7d9af7f1cbfd2445fa71ad9e7c28ee3)
| -rw-r--r-- | libavcodec/wmavoice.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/wmavoice.c b/libavcodec/wmavoice.c index 002c529a30..6cefb9a84d 100644 --- a/libavcodec/wmavoice.c +++ b/libavcodec/wmavoice.c @@ -1880,6 +1880,8 @@ static void copy_bits(PutBitContext *pb, rmn_bits = rmn_bytes = get_bits_left(gb); if (rmn_bits < nbits) return; + if (nbits > pb->size_in_bits - put_bits_count(pb)) + return; rmn_bits &= 7; rmn_bytes >>= 3; if ((rmn_bits = FFMIN(rmn_bits, nbits)) > 0) put_bits(pb, rmn_bits, get_bits(gb, rmn_bits)); |