diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-04 18:04:22 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-04 18:04:29 +0100 |
| commit | 1c896e865cfb5fdea82429a0506a1c5ad905a988 (patch) | |
| tree | de08841098f271ff27fe486ea8e87019693bd5cc /libavcodec/8bps.c | |
| parent | 39d76907c9fb8ac95bf0fe5ef95b50089ec564a9 (diff) | |
| parent | e930b112d14d7acd050d5087d11b6dd4c56a8e4e (diff) | |
| download | ffmpeg-1c896e865cfb5fdea82429a0506a1c5ad905a988.tar.gz | |
Merge commit 'e930b112d14d7acd050d5087d11b6dd4c56a8e4e' into release/0.10
* commit 'e930b112d14d7acd050d5087d11b6dd4c56a8e4e':
oma: refactor seek function
8bps: Bound-check the input buffer
rtmp: Do not misuse memcmp
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/8bps.c')
| -rw-r--r-- | libavcodec/8bps.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/8bps.c b/libavcodec/8bps.c index 9207020c9c..64cc82c1b5 100644 --- a/libavcodec/8bps.c +++ b/libavcodec/8bps.c @@ -69,7 +69,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac unsigned char *pixptr, *pixptr_end; unsigned int height = avctx->height; // Real image height unsigned int dlen, p, row; - const unsigned char *lp, *dp; + const unsigned char *lp, *dp, *ep; unsigned char count; unsigned int planes = c->planes; unsigned char *planemap = c->planemap; @@ -84,6 +84,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac return -1; } + ep = encoded + buf_size; + /* Set data pointer after line lengths */ dp = encoded + planes * (height << 1); @@ -95,16 +97,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac for(row = 0; row < height; row++) { pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; pixptr_end = pixptr + c->pic.linesize[0]; + if (ep - lp < row * 2 + 2) + return AVERROR_INVALIDDATA; dlen = av_be2ne16(*(const unsigned short *)(lp+row*2)); /* Decode a row of this plane */ while(dlen > 0) { - if(dp + 1 >= buf+buf_size) return -1; + if(ep - dp <= 1) return -1; if ((count = *dp++) <= 127) { count++; dlen -= count + 1; if (pixptr + count * planes > pixptr_end) break; - if(dp + count > buf+buf_size) return -1; + if(ep - dp < count) return -1; while(count--) { *pixptr = *dp++; pixptr += planes; |