lagarith: check count before writing zeros.
authorMichael Niedermayer <michaelni@gmx.at>
Sat, 14 Apr 2012 16:28:31 +0000 (18:28 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 14 Apr 2012 16:54:10 +0000 (18:54 +0200)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/lagarith.c

index 22d427e..7f47b75 100644 (file)
@@ -326,6 +326,10 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
 output_zeros:
     if (l->zeros_rem) {
         count = FFMIN(l->zeros_rem, width - i);
+        if(end - dst < count) {
+            av_log(l->avctx, AV_LOG_ERROR, "too many zeros remaining\n");
+            return AVERROR_INVALIDDATA;
+        }
         memset(dst, 0, count);
         l->zeros_rem -= count;
         dst += count;