diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-09-08 19:48:06 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-09-08 20:31:15 +0200 |
| commit | c0fc83ed41edec476c1b9601e1bc0177967ce206 (patch) | |
| tree | 16da9aa60f4fb748b00b57b13ce48ad0ed7e3ceb | |
| parent | 2f7a12fab5a2ea17bd78b155e9af965669fb9b52 (diff) | |
| download | ffmpeg-c0fc83ed41edec476c1b9601e1bc0177967ce206.tar.gz | |
avcodec/mlz: Check offset before writing
Fixes: 0cee183a09bff5aa5108429717c35a4d/asan_heap-oob_1d99eca_3702_9ef60e80de79082a778d3d9ce8ef3b64.mp4
Affects no release
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/mlz.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/mlz.c b/libavcodec/mlz.c index acb090824f..039635dcf1 100644 --- a/libavcodec/mlz.c +++ b/libavcodec/mlz.c @@ -81,6 +81,10 @@ static int decode_string(MLZ* mlz, unsigned char *buff, int string_code, int *fi } else { offset = dict[current_code].match_len - 1; tmp_code = dict[current_code].char_code; + if (offset >= bufsize) { + av_log(mlz->context, AV_LOG_ERROR, "MLZ offset error.\n"); + return count; + } buff[offset] = tmp_code; count++; } |