Fix potential pointer arithmetic overflows in rle_unpack() of vmd video decoder.
authorLaurent Aimar <fenrir@videolan.org>
Sat, 24 Sep 2011 22:08:51 +0000 (00:08 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 18:25:21 +0000 (20:25 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 35cb6854bb76b4a5b6f2aea2dce81e18d7ab61cd)

libavcodec/vmdav.c

index 90cbab8..1f9694e 100644 (file)
@@ -179,13 +179,13 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count,
         l = *ps++;
         if (l & 0x80) {
             l = (l & 0x7F) * 2;
-            if (pd + l > dest_end || ps_end - ps < l)
+            if (dest_end - pd < l || ps_end - ps < l)
                 return ps - src;
             memcpy(pd, ps, l);
             ps += l;
             pd += l;
         } else {
-            if (pd + i > dest_end || ps_end - ps < 2)
+            if (dest_end - pd < i || ps_end - ps < 2)
                 return ps - src;
             for (i = 0; i < l; i++) {
                 *pd++ = ps[0];