Prevent infinite loop in the ANM decoder.
authorLaurent Aimar <fenrir@videolan.org>
Fri, 30 Sep 2011 22:44:58 +0000 (00:44 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 00:41:39 +0000 (02:41 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/anm.c

index b84aef1..188f829 100644 (file)
@@ -79,6 +79,8 @@ static inline int op(uint8_t **dst, const uint8_t *dst_end,
         int striplen = FFMIN(count, remaining);
         if (buf) {
             striplen = FFMIN(striplen, buf_end - *buf);
+            if (*buf >= buf_end)
+                goto exhausted;
             memcpy(*dst, *buf, striplen);
             *buf += striplen;
         } else if (pixel >= 0)