aboutsummaryrefslogtreecommitdiffstats
path: root/libavutil
diff options
context:
space:
mode:
authorLuca Barbato <lu_zero@gentoo.org>2014-06-19 23:26:58 +0200
committerLuca Barbato <lu_zero@gentoo.org>2014-06-23 10:20:57 +0200
commitccda51b14c0fcae2fad73a24872dce75a7964996 (patch)
tree420498f29b627ee08e0e58375da3a7ec5fc93cbc /libavutil
parente121ac634ba324a318f4a97f978dcfb48da6b735 (diff)
downloadffmpeg-ccda51b14c0fcae2fad73a24872dce75a7964996.tar.gz
lzo: Handle integer overflow
get_len can overflow for specially crafted payload. Reported-By: Don A. Baley <donb@securitymouse.com> CC: libav-stable@libav.org
Diffstat (limited to 'libavutil')
-rw-r--r--libavutil/lzo.c10
1 files changed, 9 insertions, 1 deletions
diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index 5c5ebc850a..e458165261 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -80,6 +80,10 @@ static inline void copy(LZOContext *c, int cnt)
{
register const uint8_t *src = c->in;
register uint8_t *dst = c->out;
+ if (cnt < 0) {
+ c->error |= AV_LZO_ERROR;
+ return;
+ }
if (cnt > c->in_end - src) {
cnt = FFMAX(c->in_end - src, 0);
c->error |= AV_LZO_INPUT_DEPLETED;
@@ -103,7 +107,7 @@ static inline void copy(LZOContext *c, int cnt)
/**
* @brief Copies previously decoded bytes to current position.
* @param back how many bytes back we start
- * @param cnt number of bytes to copy, must be >= 0
+ * @param cnt number of bytes to copy, must be > 0
*
* cnt > back is valid, this will copy the bytes we just copied,
* thus creating a repeating pattern with a period length of back.
@@ -111,6 +115,10 @@ static inline void copy(LZOContext *c, int cnt)
static inline void copy_backptr(LZOContext *c, int back, int cnt)
{
register uint8_t *dst = c->out;
+ if (cnt <= 0) {
+ c->error |= AV_LZO_ERROR;
+ return;
+ }
if (dst - c->out_start < back) {
c->error |= AV_LZO_INVALID_BACKPTR;
return;