avcodec/vmdvideo: Check len before using it in method 3
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 16 Dec 2014 15:24:55 +0000 (16:24 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 16 Dec 2014 15:27:45 +0000 (16:27 +0100)
Fixes out of array access
Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vmdvideo.c

index fa0fbe3..a2ba1c9 100644 (file)
@@ -339,6 +339,9 @@ static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
                         ofs += slen;
                         bytestream2_skip(&gb, len);
                     } else {
+                        if (ofs + len > frame_width ||
+                            bytestream2_get_bytes_left(&gb) < len)
+                            return AVERROR_INVALIDDATA;
                         bytestream2_get_buffer(&gb, &dp[ofs], len);
                         ofs += len;
                     }