diff options
| author | Martin Storsjö <martin@martin.st> | 2013-09-29 01:24:20 +0300 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-10-04 03:52:11 +0200 |
| commit | f06e39fe6b272a11782c023c31eec43bfce3138d (patch) | |
| tree | df313b9a039dc5f350aed60bd86f398de02ba678 /libavcodec | |
| parent | 3ac156b707932e93ed5e1f23ca866e251fafb743 (diff) | |
| download | ffmpeg-f06e39fe6b272a11782c023c31eec43bfce3138d.tar.gz | |
rpza: Fix a buffer size check
We read 2 bytes for 15 out of 16 pixels, therefore we need to
have at least 30 bytes, not 16.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 7ba0cedbfeff5671b264d1d7e90777057b5714c6)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/rpza.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c index 57d4d2d228..59b15c6d4f 100644 --- a/libavcodec/rpza.c +++ b/libavcodec/rpza.c @@ -203,7 +203,7 @@ static void rpza_decode_stream(RpzaContext *s) /* Fill block with 16 colors */ case 0x00: - if (s->size - stream_ptr < 16) + if (s->size - stream_ptr < 30) return; block_ptr = row_ptr + pixel_ptr; for (pixel_y = 0; pixel_y < 4; pixel_y++) { |