diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-05 17:11:54 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-12-06 02:51:27 +0100 |
| commit | b253035ab23d4f6d4ad1f40572ad17dbd703b5e6 (patch) | |
| tree | c2bda7e2f139897ec1ba243bdb46e345829d4215 | |
| parent | ded0a0415377e2696d006a019f86eab6f1deb8d4 (diff) | |
| download | ffmpeg-b253035ab23d4f6d4ad1f40572ad17dbd703b5e6.tar.gz | |
avcodec/dirac_parser: Fix potential overflows in pointer checks
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 79798f7c57b098c78e0bbc6becd64b9888b013d1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dirac_parser.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/libavcodec/dirac_parser.c b/libavcodec/dirac_parser.c index 83c35a2010..12f1a60145 100644 --- a/libavcodec/dirac_parser.c +++ b/libavcodec/dirac_parser.c @@ -100,10 +100,12 @@ typedef struct DiracParseUnit { static int unpack_parse_unit(DiracParseUnit *pu, DiracParseContext *pc, int offset) { - uint8_t *start = pc->buffer + offset; - uint8_t *end = pc->buffer + pc->index; - if (start < pc->buffer || (start + 13 > end)) + int8_t *start; + + if (offset < 0 || pc->index - 13 < offset) return 0; + + start = pc->buffer + offset; pu->pu_type = start[4]; pu->next_pu_offset = AV_RB32(start + 5); |