diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 11:42:47 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-29 11:46:28 +0200 |
| commit | 0c6f382e855749ec45224a74ba5e07d1db52e6a0 (patch) | |
| tree | be5d6955e36e7be80653de19cc91871b727f461e /libavcodec/aasc.c | |
| parent | 5f312139dff4072c3482a0b01daafcc1446d70c8 (diff) | |
| parent | 62b1e3b1031e901105d78e831120de8e4c3e0013 (diff) | |
| download | ffmpeg-0c6f382e855749ec45224a74ba5e07d1db52e6a0.tar.gz | |
Merge commit '62b1e3b1031e901105d78e831120de8e4c3e0013'
* commit '62b1e3b1031e901105d78e831120de8e4c3e0013':
aasc: Check minimum buffer size
Conflicts:
libavcodec/aasc.c
See: e1631f8ebe9a8f2a9cca85d60160b9be94eb63f3
See: 8a57ca5c6a1c0ad28afa7ea6f824981e6761cce1
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/aasc.c')
| -rw-r--r-- | libavcodec/aasc.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c index 26ba30dd14..45d131aeb8 100644 --- a/libavcodec/aasc.c +++ b/libavcodec/aasc.c @@ -107,11 +107,9 @@ static int aasc_decode_frame(AVCodecContext *avctx, switch (compr) { case 0: stride = (avctx->width * psize + psize) & ~psize; + if (buf_size < stride * avctx->height) + return AVERROR_INVALIDDATA; for (i = avctx->height - 1; i >= 0; i--) { - if (avctx->width * psize > buf_size) { - av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n"); - break; - } memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * psize); buf += stride; buf_size -= stride; |