diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-05-31 09:59:46 +0000 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-05-31 09:59:46 +0000 |
| commit | 46adcc27a218d381fa23ea247f1dd4bc6a60e885 (patch) | |
| tree | 15408f5f8adbc0873e6c9623e35e3d57d97bae62 /libavcodec/lcldec.c | |
| parent | 1207c84adb5747d61b7ed0909d63c1a254716282 (diff) | |
| download | ffmpeg-46adcc27a218d381fa23ea247f1dd4bc6a60e885.tar.gz | |
Add sanity check for mthread_inlen, avoids crashes due to invalid reads.
Originally committed as revision 19042 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/lcldec.c')
| -rw-r--r-- | libavcodec/lcldec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index bfb2150f88..5593567500 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -190,6 +190,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac case COMP_MSZH: if (c->flags & FLAG_MULTITHREAD) { mthread_inlen = *(unsigned int*)encoded; + mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size); @@ -236,6 +237,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac if (c->flags & FLAG_MULTITHREAD) { int ret; mthread_inlen = *(unsigned int*)encoded; + mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen); |