diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-07 21:04:33 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-09 22:16:23 +0200 |
| commit | 7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd (patch) | |
| tree | 595ecd7920a2c3009339cf0d8aa2f4a8dfef509c /libavcodec | |
| parent | 524d0d2cfc7bab1b348f85e7c0369859e63781cf (diff) | |
| download | ffmpeg-7ef2dbd2392e3e4d430e0173e1e5c4df9f18b6dd.tar.gz | |
avcodec/cdgraphics: check buffer size before use
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit ad002e1a13a8df934bd6cb2c84175a4780ab8942)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index 202211d124..94ce6ae946 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -300,7 +300,9 @@ static int cdg_decode_frame(AVCodecContext *avctx, inst = bytestream_get_byte(&buf); inst &= CDG_MASK; buf += 2; /// skipping 2 unneeded bytes - bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); + + if (buf_size > CDG_HEADER_SIZE) + bytestream_get_buffer(&buf, cdg_data, buf_size - CDG_HEADER_SIZE); if ((command & CDG_MASK) == CDG_COMMAND) { switch (inst) { |