Fix potential pointer arithmetic overflows in rle_unpack() of vmd video decoder.
authorLaurent Aimar <fenrir@videolan.org>
Sat, 24 Sep 2011 22:08:51 +0000 (00:08 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 24 Sep 2011 22:42:42 +0000 (00:42 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vmdav.c

index 98bd485..6729af6 100644 (file)
@@ -179,13 +179,13 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count,
         l = *ps++;
         if (l & 0x80) {
             l = (l & 0x7F) * 2;
-            if (pd + l > dest_end || ps_end - ps < l)
+            if (dest_end - pd < l || ps_end - ps < l)
                 return ps - src;
             memcpy(pd, ps, l);
             ps += l;
             pd += l;
         } else {
-            if (pd + i > dest_end || ps_end - ps < 2)
+            if (dest_end - pd < i || ps_end - ps < 2)
                 return ps - src;
             for (i = 0; i < l; i++) {
                 *pd++ = ps[0];