git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
28e8c4d
)
lzw: prevent buffer overreads.
author
Ronald S. Bultje
<rsbultje@gmail.com>
Thu, 29 Mar 2012 00:06:00 +0000
(17:06 -0700)
committer
Ronald S. Bultje
<rsbultje@gmail.com>
Thu, 29 Mar 2012 00:38:51 +0000
(17:38 -0700)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavcodec/lzw.c
patch
|
blob
|
history
diff --git
a/libavcodec/lzw.c
b/libavcodec/lzw.c
index
873b314
..
b674d4e
100644
(file)
--- a/
libavcodec/lzw.c
+++ b/
libavcodec/lzw.c
@@
-101,9
+101,14
@@
void ff_lzw_decode_tail(LZWState *p)
struct LZWState *s = (struct LZWState *)p;
if(s->mode == FF_LZW_GIF) {
- while(s->pbuf < s->ebuf && s->bs>0){
- s->pbuf += s->bs;
- s->bs = *s->pbuf++;
+ while (s->bs > 0) {
+ if (s->pbuf + s->bs >= s->ebuf) {
+ s->pbuf = s->ebuf;
+ break;
+ } else {
+ s->pbuf += s->bs;
+ s->bs = *s->pbuf++;
+ }
}
}else
s->pbuf= s->ebuf;