vpriv_adx_decode_header: avoid underreading the array.
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 14 Nov 2012 18:15:32 +0000 (19:15 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 14 Nov 2012 18:16:08 +0000 (19:16 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/adx.c

index 870216c..7da696d 100644 (file)
@@ -47,6 +47,11 @@ int avpriv_adx_decode_header(AVCodecContext *avctx, const uint8_t *buf,
         return AVERROR_INVALIDDATA;
     offset = AV_RB16(buf + 2) + 4;
 
+    if (offset < 6) {
+        av_log(avctx, AV_LOG_ERROR, "offset is prior data\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* if copyright string is within the provided data, validate it */
     if (bufsize >= offset && memcmp(buf + offset - 6, "(c)CRI", 6))
         return AVERROR_INVALIDDATA;