RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-20 05:46:57 +00:00
Code Issues Projects Releases Wiki Activity

avutil/lzo: Fix integer overflow

Browse Source 
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)

Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb@securitymouse.com>
See: ccda51b14c
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit d6af26c55c)

Conflicts:

	libavutil/lzo.c
(cherry picked from commit 7b5c706494)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-06-20 03:15:28 +02:00
parent c1ac5896ef
commit 6a968073da
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavutil/lzo.c
View File

@ -62,7 +62,13 @@ static inline int get_byte(LZOContext *c) {
static inline int get_len(LZOContext *c, int x, int mask) {
int cnt = x & mask;
if (!cnt) {
while (!(x = get_byte(c))) cnt += 255;
while (!(x = get_byte(c))) {
if (cnt >= INT_MAX - 1000) {
c->error |= AV_LZO_ERROR;
break;
}
cnt += 255;
}
cnt += mask + x;
}
return cnt;