diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-11-28 10:54:35 +0100 |
|---|---|---|
| committer | Sean McGovern <gseanmcg@gmail.com> | 2014-04-14 16:55:39 -0400 |
| commit | ff409c7d80b6781e4b81dd860badb569061ddaa5 (patch) | |
| tree | cc035d640368bd6d8671075a36dc7bea67118e8e | |
| parent | c9be276f8b040e7d441a77f774afe94b6f137be6 (diff) | |
| download | ffmpeg-ff409c7d80b6781e4b81dd860badb569061ddaa5.tar.gz | |
adx: check that the offset is not negative
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
(cherry picked from commit 5569146d48f06564e8fa393424782cceed510916)
| -rw-r--r-- | libavcodec/adx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/adx.c b/libavcodec/adx.c index 870216c606..9b58e378c2 100644 --- a/libavcodec/adx.c +++ b/libavcodec/adx.c @@ -48,7 +48,7 @@ int avpriv_adx_decode_header(AVCodecContext *avctx, const uint8_t *buf, offset = AV_RB16(buf + 2) + 4; /* if copyright string is within the provided data, validate it */ - if (bufsize >= offset && memcmp(buf + offset - 6, "(c)CRI", 6)) + if (bufsize >= offset && offset >= 6 && memcmp(buf + offset - 6, "(c)CRI", 6)) return AVERROR_INVALIDDATA; /* check for encoding=3 block_size=18, sample_size=4 */ |