dvdsubdec.c: prevent input buffer overflow
authorJindrich Makovicka <makovick@gmail.com>
Sat, 5 Feb 2011 10:39:51 +0000 (11:39 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 7 Feb 2011 15:56:49 +0000 (16:56 +0100)
In some places, dvbsubdec passes improper input buffer size to
bitstream reading functions, not accounting for reading pointer
updates.

Fixed by using buffer_end - buffer pointer instead of fixed buffer length.

Signed-off-by: Jindrich Makovicka <makovick@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/dvbsubdec.c

index fe98798..8cc8d4f 100644 (file)
@@ -792,7 +792,7 @@ static void dvbsub_parse_pixel_data_block(AVCodecContext *avctx, DVBSubObjectDis
                 map_table = NULL;
 
             x_pos += dvbsub_read_2bit_string(pbuf + (y_pos * region->width) + x_pos,
-                                                region->width - x_pos, &buf, buf_size,
+                                                region->width - x_pos, &buf, buf_end - buf,
                                                 non_mod, map_table);
             break;
         case 0x11:
@@ -807,7 +807,7 @@ static void dvbsub_parse_pixel_data_block(AVCodecContext *avctx, DVBSubObjectDis
                 map_table = NULL;
 
             x_pos += dvbsub_read_4bit_string(pbuf + (y_pos * region->width) + x_pos,
-                                                region->width - x_pos, &buf, buf_size,
+                                                region->width - x_pos, &buf, buf_end - buf,
                                                 non_mod, map_table);
             break;
         case 0x12:
@@ -817,7 +817,7 @@ static void dvbsub_parse_pixel_data_block(AVCodecContext *avctx, DVBSubObjectDis
             }
 
             x_pos += dvbsub_read_8bit_string(pbuf + (y_pos * region->width) + x_pos,
-                                                region->width - x_pos, &buf, buf_size,
+                                                region->width - x_pos, &buf, buf_end - buf,
                                                 non_mod, NULL);
             break;