avcodec/iff: check for end of buffer in input for delta_l decompression
authorPaul B Mahol <onemda@gmail.com>
Sat, 14 May 2016 12:29:59 +0000 (14:29 +0200)
committerPaul B Mahol <onemda@gmail.com>
Sat, 14 May 2016 12:29:59 +0000 (14:29 +0200)
Signed-off-by: Paul B Mahol <onemda@gmail.com>
libavcodec/iff.c

index 3225524..674a5c2 100644 (file)
@@ -1248,7 +1248,7 @@ static void decode_delta_l(uint8_t *dst,
         bytestream2_init(&dgb, buf + 2 * poff0, buf_end - (buf + 2 * poff0));
         bytestream2_init(&ogb, buf + 2 * poff1, buf_end - (buf + 2 * poff1));
 
-        while ((bytestream2_peek_be16(&ogb)) != 0xFFFF) {
+        while ((bytestream2_peek_be16(&ogb)) != 0xFFFF && bytestream2_get_bytes_left(&ogb) >= 4) {
             uint32_t offset = bytestream2_get_be16(&ogb);
             int16_t cnt = bytestream2_get_be16(&ogb);
             uint16_t data;