diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-02 02:32:14 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-02 02:32:14 +0100 |
| commit | 7a7b1f5c4d4127ff78bed67e786d03560a9cc199 (patch) | |
| tree | ce3bd4a4da849a5a27e8ab8352131d03830f8086 /libavcodec/roqvideodec.c | |
| parent | 1eb7f39c7b8172e02a7c95073036a2c327215db8 (diff) | |
| download | ffmpeg-7a7b1f5c4d4127ff78bed67e786d03560a9cc199.tar.gz | |
roqvideodec: improve end of input buffer check
This fixes a out of array read.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/roqvideodec.c')
| -rw-r--r-- | libavcodec/roqvideodec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/roqvideodec.c b/libavcodec/roqvideodec.c index 161e7da08a..6085f4a7d0 100644 --- a/libavcodec/roqvideodec.c +++ b/libavcodec/roqvideodec.c @@ -44,7 +44,7 @@ static void roqvideo_decode_frame(RoqContext *ri) const unsigned char *buf = ri->buf; const unsigned char *buf_end = ri->buf + ri->size; - while (buf < buf_end) { + while (buf + 8 <= buf_end) { chunk_id = bytestream_get_le16(&buf); chunk_size = bytestream_get_le32(&buf); chunk_arg = bytestream_get_le16(&buf); |