diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-28 18:48:27 -0800 |
|---|---|---|
| committer | Ronald S. Bultje <rsbultje@gmail.com> | 2012-02-29 13:17:34 -0800 |
| commit | d1604b3de96575195b219028e2c4f08b2259aa7d (patch) | |
| tree | 8785741682e7ebca132fd6e97dcbbc009760bb7b /libavcodec/h264_cabac.c | |
| parent | f240df6a7415c7cf44e2edeec309d137759da546 (diff) | |
| download | ffmpeg-d1604b3de96575195b219028e2c4f08b2259aa7d.tar.gz | |
h264: prevent overreads in intra PCM decoding.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/h264_cabac.c')
| -rw-r--r-- | libavcodec/h264_cabac.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/h264_cabac.c b/libavcodec/h264_cabac.c index 75fb02cb63..2ee4bc01a8 100644 --- a/libavcodec/h264_cabac.c +++ b/libavcodec/h264_cabac.c @@ -1996,6 +1996,8 @@ decode_intra_mb: } // The pixels are stored in the same order as levels in h->mb array. + if ((int) (h->cabac.bytestream_end - ptr) < mb_size) + return -1; memcpy(h->mb, ptr, mb_size); ptr+=mb_size; ff_init_cabac_decoder(&h->cabac, ptr, h->cabac.bytestream_end - ptr); |