git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
b8eb8b0
)
avcodec/vmdvideo: Check len before using it in method 3
author
Michael Niedermayer
<michaelni@gmx.at>
Tue, 16 Dec 2014 15:24:55 +0000
(16:24 +0100)
committer
Michael Niedermayer
<michaelni@gmx.at>
Tue, 16 Dec 2014 15:27:45 +0000
(16:27 +0100)
Fixes out of array access
Fixes: asan_heap-oob_4d23ba_91_cov_3853393937_128.vmd
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vmdvideo.c
patch
|
blob
|
history
diff --git
a/libavcodec/vmdvideo.c
b/libavcodec/vmdvideo.c
index
fa0fbe3
..
a2ba1c9
100644
(file)
--- a/
libavcodec/vmdvideo.c
+++ b/
libavcodec/vmdvideo.c
@@
-339,6
+339,9
@@
static int vmd_decode(VmdVideoContext *s, AVFrame *frame)
ofs += slen;
bytestream2_skip(&gb, len);
} else {
+ if (ofs + len > frame_width ||
+ bytestream2_get_bytes_left(&gb) < len)
+ return AVERROR_INVALIDDATA;
bytestream2_get_buffer(&gb, &dp[ofs], len);
ofs += len;
}