RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

paf: prevent invalid write 

Closes #1631.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2012-08-13 12:26:38 +00:00
parent c3da2c19e4
commit bd70a52712
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/paf.c
View File

@ -164,14 +164,16 @@ static int decode_0(AVCodecContext *avctx, uint8_t code, uint8_t *pkt)
} while (--i);
}
dst = c->frame[c->current_frame];
dst = c->frame[c->current_frame];
dend = c->frame[c->current_frame] + c->frame_size;
do {
a = bytestream2_get_byte(&c->gb);
b = bytestream2_get_byte(&c->gb);
p = (a & 0xC0) >> 6;
src = c->frame[p] + get_video_page_offset(avctx, a, b);
send = c->frame[p] + c->frame_size;
if (src + 3 * avctx->width + 4 > send)
if ((src + 3 * avctx->width + 4 > send) ||
(dst + 3 * avctx->width + 4 > dend))
return AVERROR_INVALIDDATA;
copy_block4(dst, src, avctx->width, avctx->width, 4);
i++;