git.videolan.org
/
ffmpeg.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
| inline |
side by side
avcodec/vmdvideo: Check len before using it in method 3
[ffmpeg.git]
/
libavcodec
/
vmdvideo.c
diff --git
a/libavcodec/vmdvideo.c
b/libavcodec/vmdvideo.c
index
fa0fbe3
..
a2ba1c9
100644
(file)
--- a/
libavcodec/vmdvideo.c
+++ b/
libavcodec/vmdvideo.c
@@
-339,6
+339,9
@@
static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
ofs += slen;
bytestream2_skip(&gb, len);
} else {
+ if (ofs + len > frame_width ||
+ bytestream2_get_bytes_left(&gb) < len)
+ return AVERROR_INVALIDDATA;
bytestream2_get_buffer(&gb, &dp[ofs], len);
ofs += len;
}