RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

bmv: check for len being valid in bmv_decode_frame(). 

It can be 0 or -1 for invalid files, which may result in invalid memory
access.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-03-28 10:09:36 +01:00
parent 8d617b11cf
commit b88f902125
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/bmv.c
View File

@ -135,7 +135,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
mode += 1 + advance_mode;
if (mode >= 4)
mode -= 3;
if (FFABS(dst_end - dst) < len)
if (len <= 0 || FFABS(dst_end - dst) < len)
return AVERROR_INVALIDDATA;
switch (mode) {
case 1: