diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-05 21:35:23 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-05 21:36:14 +0100 |
| commit | d4a731b84a08f0f3839eaaaf82e97d8d9c67da46 (patch) | |
| tree | b624b837314399bc68490cb84960b80abbd7b524 | |
| parent | c9bfd6a8c35a2102e730aca12f6e09d1627f76b3 (diff) | |
| download | ffmpeg-d4a731b84a08f0f3839eaaaf82e97d8d9c67da46.tar.gz | |
avcodec/faxcompr: Add missing runs check in decode_uncompressed()
Fixes out of array access
Fixes: 54e488b9da4abbceaf405d6492515697/asan_heap-oob_32769b0_160_a8755eb08ee8f9579348501945a33955.TIF
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/faxcompr.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/faxcompr.c b/libavcodec/faxcompr.c index 80df418a29..2a1d2bc3f6 100644 --- a/libavcodec/faxcompr.c +++ b/libavcodec/faxcompr.c @@ -189,6 +189,10 @@ static int decode_uncompressed(AVCodecContext *avctx, GetBitContext *gb, *mode = !*mode; if (newmode != *mode) { //FIXME CHECK *(*runs)++ = 0; + if (*runs >= runend) { + av_log(avctx, AV_LOG_ERROR, "uncompressed run overrun\n"); + return AVERROR_INVALIDDATA; + } *mode = newmode; } return 0; |