aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-11-22 23:48:58 +0100
committerMichael Niedermayer <michaelni@gmx.at>2013-11-22 23:52:08 +0100
commitffe31c654d0e7218ca36fb7884bac35736e232bb (patch)
tree6a88fcabfc202b86782ebc05e369337a9b16adf5
parent5c4aa72b75c1715d031df38d925445698be67de4 (diff)
downloadffmpeg-ffe31c654d0e7218ca36fb7884bac35736e232bb.tar.gz
avcodec/hnm4video: check writeoffset in decode_interframe_v4a()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/hnm4video.c8
1 files changed, 8 insertions, 0 deletions
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c
index f394032288..742b1d3346 100644
--- a/libavcodec/hnm4video.c
+++ b/libavcodec/hnm4video.c
@@ -287,6 +287,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src,
if (tag == 0) {
writeoffset += bytestream2_get_byte(&gb);
} else if (tag == 1) {
+ if (writeoffset + hnm->width >= hnm->width * hnm->height) {
+ av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
+ break;
+ }
hnm->current[writeoffset] = bytestream2_get_byte(&gb);
hnm->current[writeoffset + hnm->width] = bytestream2_get_byte(&gb);
writeoffset++;
@@ -295,6 +299,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src,
} else if (tag == 3) {
break;
}
+ if (writeoffset > hnm->width * hnm->height) {
+ av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
+ break;
+ }
} else {
delta = bytestream2_peek_byte(&gb) & 0x80;
previous = bytestream2_peek_byte(&gb) & 0x40;