diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-01-11 16:36:52 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-01-11 16:37:31 +0100 |
| commit | 8d06be6b8ce7f411f0b1a614cad88a9719a21a5a (patch) | |
| tree | 2c370090d19a8e4d6433275fd719bdb39773c7e8 /libavcodec | |
| parent | 85a4dbeb9c9aa8b22ca5a7b76aa48f6f44735156 (diff) | |
| download | ffmpeg-8d06be6b8ce7f411f0b1a614cad88a9719a21a5a.tar.gz | |
wavpack: check pointer to avoid overreading input buffer
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/wavpack.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 6b67f30b21..574ce15d08 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -906,7 +906,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, continue; } t = 0; - for (i = s->terms - 1; (i >= 0) && (t < size); i--) { + for (i = s->terms - 1; (i >= 0) && (t < size) && buf <= buf_end; i--) { if (s->decorr[i].value > 8) { s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf)); buf += 2; s->decorr[i].samplesA[1] = wp_exp2(AV_RL16(buf)); buf += 2; @@ -921,7 +921,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf)); buf += 2; t += 4; } else { - for (j = 0; j < s->decorr[i].value; j++) { + for (j = 0; j < s->decorr[i].value && buf+1<buf_end; j++) { s->decorr[i].samplesA[j] = wp_exp2(AV_RL16(buf)); buf += 2; if (s->stereo_in) { s->decorr[i].samplesB[j] = wp_exp2(AV_RL16(buf)); buf += 2; |