swfdec: check space before copy
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 12 Nov 2012 18:29:08 +0000 (19:29 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 12 Nov 2012 18:29:27 +0000 (19:29 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/swfdec.c

index b8c2e93..193df25 100644 (file)
@@ -362,6 +362,11 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt)
             default:
                 av_assert0(0);
             }
+
+            if (linesize * height > pkt->size) {
+                res = AVERROR_INVALIDDATA;
+                goto bitmap_end;
+            }
             memcpy(pkt->data, buf + colormapsize*colormapbpp, linesize * height);
 
             res = pkt->size;