RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

xan: check size_segment before reading, fixes out of array read. 

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-12 20:42:33 +01:00
parent a9456c7c5c
commit 0e239b22db
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/xan.c
View File

@ -359,17 +359,29 @@ static int xan_wc3_decode_frame(XanContext *s) {
case 9:
case 19:
if (buf_end - size_segment < 1) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = *size_segment++;
break;
case 10:
case 20:
if (buf_end - size_segment < 2) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = AV_RB16(&size_segment[0]);
size_segment += 2;
break;
case 11:
case 21:
if (buf_end - size_segment < 3) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = AV_RB24(size_segment);
size_segment += 3;
break;