RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

vqavideo: check for out of bound reads. 

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-10-09 01:54:41 +02:00 committed by Michael Niedermayer
parent e3123856c7
commit 6d45702f7f
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/vqavideo.c
View File

@ -230,6 +230,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2;
av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos);
CHECK_COUNT();
if (src_pos + count > dest_size)
return;
for (i = 0; i < count; i++)
dest[dest_index + i] = dest[src_pos + i];
dest_index += count;
@ -252,6 +254,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2;
av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos);
CHECK_COUNT();
if (src_pos + count > dest_size)
return;
for (i = 0; i < count; i++)
dest[dest_index + i] = dest[src_pos + i];
dest_index += count;
@ -272,6 +276,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2;
av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos);
CHECK_COUNT();
if (dest_index < src_pos)
return;
for (i = 0; i < count; i++)
dest[dest_index + i] = dest[dest_index - src_pos + i];
dest_index += count;