git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
3ba5843
)
zmbvdec: check decompression buffer size.
author
Michael Niedermayer
<michaelni@gmx.at>
Sun, 11 Nov 2012 17:08:39 +0000
(18:08 +0100)
committer
Michael Niedermayer
<michaelni@gmx.at>
Sun, 11 Nov 2012 17:09:11 +0000
(18:09 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/zmbv.c
patch
|
blob
|
history
diff --git
a/libavcodec/zmbv.c
b/libavcodec/zmbv.c
index
762d572
..
8727bfc
100644
(file)
--- a/
libavcodec/zmbv.c
+++ b/
libavcodec/zmbv.c
@@
-502,8
+502,11
@@
static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
}
if (c->comp == 0) { //Uncompressed data
+ if (c->decomp_size < len) {
+ av_log(avctx, AV_LOG_ERROR, "decomp buffer too small\n");
+ return AVERROR_INVALIDDATA;
+ }
memcpy(c->decomp_buf, buf, len);
- c->decomp_size = 1;
} else { // ZLIB-compressed data
c->zstream.total_in = c->zstream.total_out = 0;
c->zstream.next_in = (uint8_t*)buf;