diff options
| author | Andreas Cadhalpun <andreas.cadhalpun@googlemail.com> | 2015-05-05 21:33:08 +0200 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-05-14 19:10:06 +0200 |
| commit | f78d7e6a03147f918033146afbf17e96d66d1cce (patch) | |
| tree | 57ad12922058c66a1c717c2676125029e97120a4 | |
| parent | 0cb8d786f29c1cac6639ae7d84f5af40553793b4 (diff) | |
| download | ffmpeg-f78d7e6a03147f918033146afbf17e96d66d1cce.tar.gz | |
diracdec: prevent overflow in data_unit_size check
buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.
This causes a segmentation fault.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 984f50deb2d48f6844d65e10991b996a6d29e87c)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
| -rw-r--r-- | libavcodec/diracdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/diracdec.c b/libavcodec/diracdec.c index 05e954bd63..0453a97928 100644 --- a/libavcodec/diracdec.c +++ b/libavcodec/diracdec.c @@ -1937,8 +1937,8 @@ static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, break; data_unit_size = AV_RB32(buf+buf_idx+5); - if (buf_idx + data_unit_size > buf_size || !data_unit_size) { - if(buf_idx + data_unit_size > buf_size) + if (data_unit_size > buf_size - buf_idx || !data_unit_size) { + if(data_unit_size > buf_size - buf_idx) av_log(s->avctx, AV_LOG_ERROR, "Data unit with size %d is larger than input buffer, discarding\n", data_unit_size); |