diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-05 03:08:09 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2016-01-05 03:08:09 +0100 |
| commit | 68eb20801d6929974feb41219290cb4c207cdf59 (patch) | |
| tree | a34e5a8aade12ea9d788ecb340bd8e9a365e3575 /libavcodec | |
| parent | eb8a67de75ef6fd043f5749f6448c1874f149783 (diff) | |
| download | ffmpeg-68eb20801d6929974feb41219290cb4c207cdf59.tar.gz | |
avcodec/dxv: Check idx in dxv_decompress_dxt5()
Fixes potential out of array read
No testcase available
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/dxv.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index f1ea2987ae..05a9aadd24 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -260,6 +260,10 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx) case 2: /* Copy two dwords from a previous index */ idx = 8 + bytestream2_get_le16(gbc); + if (idx > pos) { + av_log(avctx, AV_LOG_ERROR, "idx %d > %d\n", idx, pos); + return AVERROR_INVALIDDATA; + } prev = AV_RL32(ctx->tex_data + 4 * (pos - idx)); AV_WL32(ctx->tex_data + 4 * pos, prev); pos++; |