diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-07 21:04:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-07 21:06:48 +0200 |
| commit | ad002e1a13a8df934bd6cb2c84175a4780ab8942 (patch) | |
| tree | b27f13de5c301d903bbea5fd921c1725eb5edcfc /libavcodec/cdgraphics.c | |
| parent | ead590c2561980f2afda38a662364659577dca38 (diff) | |
| download | ffmpeg-ad002e1a13a8df934bd6cb2c84175a4780ab8942.tar.gz | |
avcodec/cdgraphics: check buffer size before use
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/cdgraphics.c')
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index d22e9f6e73..ed2edfe450 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -289,7 +289,9 @@ static int cdg_decode_frame(AVCodecContext *avctx, inst = bytestream_get_byte(&buf); inst &= CDG_MASK; buf += 2; /// skipping 2 unneeded bytes - bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); + + if (buf_size > CDG_HEADER_SIZE) + bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); if ((command & CDG_MASK) == CDG_COMMAND) { switch (inst) { |