diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 16:50:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 17:24:13 +0200 |
| commit | 1e5c7376c4ed733910845c9a09e272ac7696b1f4 (patch) | |
| tree | d52794f199d6c57c1c6df52eac58733d8674ecac /libavcodec | |
| parent | 83de4f5fc92b1424c7d77f3411572a9a00eff672 (diff) | |
| download | ffmpeg-1e5c7376c4ed733910845c9a09e272ac7696b1f4.tar.gz | |
cdgraphics: Fix out of array write
Fixes Ticket1359
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index d0cc2126ef..d7b85100ae 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n"); return AVERROR(EINVAL); } + if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) { + av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n"); + return AVERROR(EINVAL); + } ret = avctx->reget_buffer(avctx, &cc->frame); if (ret) { |