From 8d06be6b8ce7f411f0b1a614cad88a9719a21a5a Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 11 Jan 2013 16:36:52 +0100 Subject: [PATCH] wavpack: check pointer to avoid overreading input buffer Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/wavpack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/wavpack.c b/libavcodec/wavpack.c index 6b67f30b21..574ce15d08 100644 --- a/libavcodec/wavpack.c +++ b/libavcodec/wavpack.c @@ -906,7 +906,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, continue; } t = 0; - for (i = s->terms - 1; (i >= 0) && (t < size); i--) { + for (i = s->terms - 1; (i >= 0) && (t < size) && buf <= buf_end; i--) { if (s->decorr[i].value > 8) { s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf)); buf += 2; s->decorr[i].samplesA[1] = wp_exp2(AV_RL16(buf)); buf += 2; @@ -921,7 +921,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no, s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf)); buf += 2; t += 4; } else { - for (j = 0; j < s->decorr[i].value; j++) { + for (j = 0; j < s->decorr[i].value && buf+1decorr[i].samplesA[j] = wp_exp2(AV_RL16(buf)); buf += 2; if (s->stereo_in) { s->decorr[i].samplesB[j] = wp_exp2(AV_RL16(buf)); buf += 2;