diff options
author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2007-01-27 14:15:03 +0000 |
---|---|---|
committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2007-01-27 14:15:03 +0000 |
commit | cf0ef3dc3436104ee0c63259d0f950c824e94a4e (patch) | |
tree | 1708ae3294123f1df90c5bd0a102562ed6c31938 /libavcodec/lzo.c | |
parent | 30b9d5f62210efa4a10213fea483cba7108dceb4 (diff) | |
download | ffmpeg-cf0ef3dc3436104ee0c63259d0f950c824e94a4e.tar.gz |
Fix buffer end checks in lzo copy code to work in all cases.
Originally committed as revision 7731 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/lzo.c')
-rw-r--r-- | libavcodec/lzo.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/libavcodec/lzo.c b/libavcodec/lzo.c index 8fc3ec845f..eed3b8cf56 100644 --- a/libavcodec/lzo.c +++ b/libavcodec/lzo.c @@ -67,11 +67,11 @@ static inline int get_len(LZOContext *c, int x, int mask) { static inline void copy(LZOContext *c, int cnt) { register uint8_t *src = c->in; register uint8_t *dst = c->out; - if (src + cnt > c->in_end) { + if (src + cnt > c->in_end || src + cnt < src) { cnt = c->in_end - src; c->error |= LZO_INPUT_DEPLETED; } - if (dst + cnt > c->out_end) { + if (dst + cnt > c->out_end || dst + cnt < dst) { cnt = c->out_end - dst; c->error |= LZO_OUTPUT_FULL; } @@ -101,11 +101,11 @@ static inline void copy(LZOContext *c, int cnt) { static inline void copy_backptr(LZOContext *c, int back, int cnt) { register uint8_t *src = &c->out[-back]; register uint8_t *dst = c->out; - if (src < c->out_start) { + if (src < c->out_start || src > dst) { c->error |= LZO_INVALID_BACKPTR; return; } - if (dst + cnt > c->out_end) { + if (dst + cnt > c->out_end || dst + cnt < dst) { cnt = c->out_end - dst; c->error |= LZO_OUTPUT_FULL; } |