Check for out of bound reads in xan_huffman_decode() of the xan decoder.
authorLaurent Aimar <fenrir@videolan.org>
Tue, 27 Sep 2011 22:45:54 +0000 (00:45 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sat, 1 Oct 2011 18:53:44 +0000 (20:53 +0200)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c8b835954ae4aef797112afda3b52f8dfe3c7b74)

libavcodec/xan.c

index b903539..fe9eece 100644 (file)
@@ -114,7 +114,10 @@ static int xan_huffman_decode(unsigned char *dest, int dest_len,
     init_get_bits(&gb, ptr, ptr_len * 8);
 
     while ( val != 0x16 ) {
-        val = src[val - 0x17 + get_bits1(&gb) * byte];
+        unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
+        if (idx >= 2 * byte)
+            return -1;
+        val = src[idx];
 
         if ( val < 0x16 ) {
             if (dest >= dest_end)