diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-10-26 16:29:57 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-12-05 18:29:12 +0100 |
| commit | b7940ecb5a9467066f7c1228b059588f539807bf (patch) | |
| tree | 02e5c417c85f85b71bbc929b4ed178fd4dbb6a04 /libavcodec/dvdsubdec.c | |
| parent | 2dcc0bce3924ebc96ed7f4956b007d4b84a99750 (diff) | |
| download | ffmpeg-b7940ecb5a9467066f7c1228b059588f539807bf.tar.gz | |
avcodec/dvdsubdec: Fix buf_size check
Fixes out of array access
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25ab1a65f3acb5ec67b53fb7a2463a7368f1ad16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/dvdsubdec.c')
| -rw-r--r-- | libavcodec/dvdsubdec.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index 19f25f0e60..783a24fc1a 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -548,7 +548,8 @@ static int append_to_cached_buf(AVCodecContext *avctx, { DVDSubContext *ctx = avctx->priv_data; - if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) { + av_assert0(buf_size >= 0 && ctx->buf_size <= sizeof(ctx->buf)); + if (buf_size >= sizeof(ctx->buf) - ctx->buf_size) { av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct " "too large SPU packets aborted.\n"); ctx->buf_size = 0; |