diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-03-29 04:25:50 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-29 04:27:00 +0100 |
| commit | 46f72ea507afee6adb0d2324848159063d0e7afc (patch) | |
| tree | 0d3c9cc89115a5a1a8d7881b2cce93a54e86752c /libavcodec/vp8.c | |
| parent | 067ada04d19629fb0afefffda27bcd5ebdffc0e8 (diff) | |
| download | ffmpeg-46f72ea507afee6adb0d2324848159063d0e7afc.tar.gz | |
avcodec/vp7: check buffer size
Fixes overread
Fixes Ticket 3501
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vp8.c')
| -rw-r--r-- | libavcodec/vp8.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c index 45a19a04e4..c15111e2dd 100644 --- a/libavcodec/vp8.c +++ b/libavcodec/vp8.c @@ -434,6 +434,11 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si s->invisible = 0; part1_size = AV_RL24(buf) >> 4; + if (buf_size < 4 - s->profile + part1_size) { + av_log(s->avctx, AV_LOG_ERROR, "Buffer size %d is too small, needed : %d\n", buf_size, 4 - s->profile + part1_size); + return AVERROR_INVALIDDATA; + } + buf += 4 - s->profile; buf_size -= 4 - s->profile; |