diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-02-25 12:29:10 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-21 01:52:51 +0100 |
| commit | 711374b62691ed42099ea9350ba6e6f9846012a2 (patch) | |
| tree | 00dcc21d26499c34471725e7a823acb252aedf50 /libavcodec | |
| parent | 9a63a36dc6e15f0b764425f17bb4cb8e7e61f3e7 (diff) | |
| download | ffmpeg-711374b62691ed42099ea9350ba6e6f9846012a2.tar.gz | |
avcodec/zmbv: Check len before reading in decode_frame()
Fixes out of array read
Fixes: asan_heap-oob_4d4eb0_3994_cov_3169972261_zmbv_15bit.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1f5c7781e63d6519192ada59c1e36bcecc92791d)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/zmbv.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/zmbv.c b/libavcodec/zmbv.c index c16d912117..82ae169ef4 100644 --- a/libavcodec/zmbv.c +++ b/libavcodec/zmbv.c @@ -410,11 +410,16 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame, AVPac int hi_ver, lo_ver, ret; /* parse header */ + if (len < 1) + return AVERROR_INVALIDDATA; c->flags = buf[0]; buf++; len--; if (c->flags & ZMBV_KEYFRAME) { void *decode_intra = NULL; c->decode_intra= NULL; + + if (len < 6) + return AVERROR_INVALIDDATA; hi_ver = buf[0]; lo_ver = buf[1]; c->comp = buf[2]; |