diracdec: prevent overflow in data_unit_size check
authorAndreas Cadhalpun <andreas.cadhalpun@googlemail.com>
Tue, 5 May 2015 19:33:08 +0000 (21:33 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 5 May 2015 19:52:31 +0000 (21:52 +0200)
buf_idx + data_unit_size can overflow, causing the '> buf_size' check to
wrongly fail.

This causes a segmentation fault.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/diracdec.c

index 05e954b..0453a97 100644 (file)
@@ -1937,8 +1937,8 @@ static int dirac_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
             break;
 
         data_unit_size = AV_RB32(buf+buf_idx+5);
-        if (buf_idx + data_unit_size > buf_size || !data_unit_size) {
-            if(buf_idx + data_unit_size > buf_size)
+        if (data_unit_size > buf_size - buf_idx || !data_unit_size) {
+            if(data_unit_size > buf_size - buf_idx)
             av_log(s->avctx, AV_LOG_ERROR,
                    "Data unit with size %d is larger than input buffer, discarding\n",
                    data_unit_size);