diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-03-27 18:18:38 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2013-04-04 07:54:07 +0200 |
| commit | 3623589edc7b1257bb45aa9e52c9631e133f22b6 (patch) | |
| tree | c8537e8f5df643f239f7b531d31c142806dfb2bd /libavcodec/dfa.c | |
| parent | dbb1425811a672eddf4acf0513237cdf20f83756 (diff) | |
| download | ffmpeg-3623589edc7b1257bb45aa9e52c9631e133f22b6.tar.gz | |
dfa: check for invalid access in decode_wdlt().
This can happen when the number of skipped lines is not consistent with
the number of coded lines.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/dfa.c')
| -rw-r--r-- | libavcodec/dfa.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index bbe4ce2888..6619b98301 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -255,6 +255,8 @@ static int decode_wdlt(GetByteContext *gb, uint8_t *frame, int width, int height segments = bytestream2_get_le16(gb); } line_ptr = frame; + if (frame_end - frame < width) + return AVERROR_INVALIDDATA; frame += width; y++; while (segments--) { |