diff options
| author | Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> | 2015-05-05 21:33:08 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-17 21:50:09 +0200 |
| commit | a64102e25fb94159ee548cb7fb59322770faf7f7 (patch) | |
| tree | 4dabf5e788a1ed5795bbdc20b323a15ca24d0250 | |
| parent | 4f0d1af68ad352dbfcb079e52fd333622c274a5b (diff) | |
| download | ffmpeg-a64102e25fb94159ee548cb7fb59322770faf7f7.tar.gz | |
diracdec: prevent overflow in data_unit_size check
buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.
This causes a segmentation fault.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/diracdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 1edeab958f..ebbe80bb3e 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1937,8 +1937,8 @@ static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, break; data_unit_size = AV_RB32(buf+buf_idx+5); - if (buf_idx + data_unit_size > buf_size || !data_unit_size) { - if(buf_idx + data_unit_size > buf_size) + if (data_unit_size > buf_size - buf_idx || !data_unit_size) { + if(data_unit_size > buf_size - buf_idx) av_log(s->avctx, AV_LOG_ERROR, "Data unit with size %d is larger than input buffer, discarding\n", data_unit_size); |