diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-18 19:28:51 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-20 13:39:37 +0100 |
| commit | 778c8de40f2c8d8bdbdf9a52306c59b6a425d401 (patch) | |
| tree | dc9d5a6307ba1babd2ee02578d4c1546811cb30d | |
| parent | 38f8c80901033042488579c8975efb39ab153793 (diff) | |
| download | ffmpeg-778c8de40f2c8d8bdbdf9a52306c59b6a425d401.tar.gz | |
xwddec: prevent overflow of lsize * avctx->height
This is used to check if the input buffer is large enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.
Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 9d38f06d05efbb9d6196c27668eb943e934943ae)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavcodec/xwddec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/xwddec.c b/libavcodec/xwddec.c index 2febedc4aa..64cd8418a2 100644 --- a/libavcodec/xwddec.c +++ b/libavcodec/xwddec.c @@ -141,7 +141,7 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } - if (bytestream2_get_bytes_left(&gb) < ncolors * XWD_CMAP_SIZE + avctx->height * lsize) { + if (bytestream2_get_bytes_left(&gb) < ncolors * XWD_CMAP_SIZE + (uint64_t)avctx->height * lsize) { av_log(avctx, AV_LOG_ERROR, "input buffer too small\n"); return AVERROR_INVALIDDATA; } |