diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-12-18 19:28:51 +0100 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2016-01-13 09:39:13 +0100 |
| commit | 8431629dd112874293380a6d8a852459fc1a76b6 (patch) | |
| tree | 57f232cf34f774d25b339f88d8d08ba464a26a55 /libavcodec | |
| parent | 5b83b24ccbec79359f2dcdc0f49e09010a05e58a (diff) | |
| download | ffmpeg-8431629dd112874293380a6d8a852459fc1a76b6.tar.gz | |
xwddec: prevent overflow of lsize * avctx->height
This is used to check if the input buffer is larger enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Anton Khirnov <anton@khirnov.net>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/xwddec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/xwddec.c b/libavcodec/xwddec.c index f6d3d97de5..1c9874aa32 100644 --- a/libavcodec/xwddec.c +++ b/libavcodec/xwddec.c @@ -141,7 +141,7 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data, return AVERROR_INVALIDDATA; } - if (bytestream2_get_bytes_left(&gb) < ncolors * XWD_CMAP_SIZE + avctx->height * lsize) { + if (bytestream2_get_bytes_left(&gb) < ncolors * XWD_CMAP_SIZE + (uint64_t)avctx->height * lsize) { av_log(avctx, AV_LOG_ERROR, "input buffer too small\n"); return AVERROR_INVALIDDATA; } |