diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-03-27 18:18:38 +0100 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-05-09 20:05:52 +0200 |
| commit | 96cf80609af6372d4e0d150b8a5ca517c072e897 (patch) | |
| tree | c6d60d5f43e2eb5ba0a248428e4c07994c1108a5 | |
| parent | 33c9e18b09f4025ae635ef24bab8eab1a686a711 (diff) | |
| download | ffmpeg-96cf80609af6372d4e0d150b8a5ca517c072e897.tar.gz | |
dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3623589edc7b1257bb45aa9e52c9631e133f22b6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/dfa.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index 9c80b3c4e8..563d7d5a1d 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -263,6 +263,8 @@ static int decode_wdlt(uint8_t *frame, int width, int height, segments = bytestream_get_le16(&src); } line_ptr = frame; + if (frame_end - frame < width) + return AVERROR_INVALIDDATA; frame += width; y++; while (segments--) { |