avcodec/g2meet: check available space before copying palette
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 26 Nov 2013 20:53:47 +0000 (21:53 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 26 Nov 2013 23:10:23 +0000 (00:10 +0100)
Fixes out of array read
Fixes: asan_heap-uaf_ae6067_5415_g2m4.wmv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/g2meet.c

index 663028f..4f26258 100644 (file)
@@ -375,6 +375,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
         src += 3;
     }
     npal = *src++ + 1;
+    if (src_end - src < npal * 3)
+        return AVERROR_INVALIDDATA;
     memcpy(pal, src, npal * 3); src += npal * 3;
     if (sub_type != 2) {
         for (i = 0; i < npal; i++) {