xxan: don't read before start of buffer in av_memcpy_backptr().

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Ronald S. Bultje 2012-03-08 16:32:46 -08:00
parent a928ed3751
commit f1279e286b
1 changed files with 2 additions and 1 deletions

View File

@ -129,7 +129,8 @@ static int xan_unpack(uint8_t *dest, const int dest_len,
if (size + size2 > dest_end - dest)
break;
}
if (src + size > src_end || dest + size + size2 > dest_end)
if (src + size > src_end || dest + size + size2 > dest_end ||
dest - orig_dest + size < back)
return -1;
bytestream_get_buffer(&src, dest, size);
dest += size;