Check for out of bound reads in the Electronic Arts CMV decoder.
authorLaurent Aimar <fenrir@videolan.org>
Fri, 30 Sep 2011 22:45:01 +0000 (00:45 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 19:03:31 +0000 (21:03 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit a5d46235f3f70f0b620f8e54649ece45ecc5b170)

libavcodec/eacmv.c

index 6e3b519..4cd6a6f 100644 (file)
@@ -158,6 +158,9 @@ static int cmv_decode_frame(AVCodecContext *avctx,
     CmvContext *s = avctx->priv_data;
     const uint8_t *buf_end = buf + buf_size;
 
+    if (buf_end - buf < EA_PREAMBLE_SIZE)
+        return AVERROR_INVALIDDATA;
+
     if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) {
         cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end);
         return buf_size;