RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-19 05:40:56 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/dvdsubdec: Fix buf_size check

Browse Source 
Fixes out of array access

Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-10-26 16:29:57 +02:00
parent 20182e79f9
commit 25ab1a65f3
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/dvdsubdec.c
View File

@ -548,7 +548,8 @@ static int append_to_cached_buf(AVCodecContext *avctx,
{ {
DVDSubContext *ctx = avctx->priv_data; DVDSubContext *ctx = avctx->priv_data;
if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) { av_assert0(buf_size >= 0 && ctx->buf_size <= sizeof(ctx->buf));
if (buf_size >= sizeof(ctx->buf) - ctx->buf_size) {
av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct " av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
"too large SPU packets aborted.\n"); "too large SPU packets aborted.\n");
ctx->buf_size = 0; ctx->buf_size = 0;