mirror of https://git.ffmpeg.org/ffmpeg.git
Add two extra needed bounds checks
Originally committed as revision 7777 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
parent
801778bc83
commit
5fe9c42ceb
|
@ -182,6 +182,8 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) {
|
||||||
x = GETB(c);
|
x = GETB(c);
|
||||||
if (x < 16) c.error |= LZO_ERROR;
|
if (x < 16) c.error |= LZO_ERROR;
|
||||||
}
|
}
|
||||||
|
if (c.in > c.in_end)
|
||||||
|
c.error |= LZO_INPUT_DEPLETED;
|
||||||
while (!c.error) {
|
while (!c.error) {
|
||||||
int cnt, back;
|
int cnt, back;
|
||||||
if (x > 15) {
|
if (x > 15) {
|
||||||
|
@ -209,6 +211,10 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) {
|
||||||
cnt = get_len(&c, x, 15);
|
cnt = get_len(&c, x, 15);
|
||||||
copy(&c, cnt + 3);
|
copy(&c, cnt + 3);
|
||||||
x = GETB(c);
|
x = GETB(c);
|
||||||
|
if (c.in > c.in_end) {
|
||||||
|
c.error |= LZO_INPUT_DEPLETED;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
if (x >> 4)
|
if (x >> 4)
|
||||||
continue;
|
continue;
|
||||||
cnt = 1;
|
cnt = 1;
|
||||||
|
|
Loading…
Reference in New Issue