diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 03:03:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-14 03:03:35 +0100 |
| commit | e1631f8ebe9a8f2a9cca85d60160b9be94eb63f3 (patch) | |
| tree | 1a673b6b6d4a3f58c4995e601e0bb5911e90d2bc | |
| parent | 39c5cd601ef09b1a540471960cb3a7e3ba17cb3c (diff) | |
| download | ffmpeg-e1631f8ebe9a8f2a9cca85d60160b9be94eb63f3.tar.gz | |
aasc: check before reading the first 4 byte, fix overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/aasc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c index a759e0d336..6c9fd4e428 100644 --- a/libavcodec/aasc.c +++ b/libavcodec/aasc.c @@ -83,6 +83,11 @@ static int aasc_decode_frame(AVCodecContext *avctx, AascContext *s = avctx->priv_data; int compr, i, stride, psize; + if (buf_size < 4) { + av_log(avctx, AV_LOG_ERROR, "frame too short\n"); + return AVERROR_INVALIDDATA; + } + s->frame.reference = 3; s->frame.buffer_hints = FF_BUFFER_HINTS_VALID | FF_BUFFER_HINTS_PRESERVE | FF_BUFFER_HINTS_REUSABLE; if (avctx->reget_buffer(avctx, &s->frame)) { |