diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-13 15:45:04 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-13 15:45:04 +0100 |
| commit | be5db7004f9d7b42b5ae9068b181dff383367e36 (patch) | |
| tree | 79b33d3f789fd54fff3ca106d696f08b810940f7 /libavcodec/aasc.c | |
| parent | a6c4c0f2740bc8e65aa68b890fedae42ca7a83cf (diff) | |
aascdec: Check input buffer size on raw data.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/aasc.c')
| -rw-r--r-- | libavcodec/aasc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c index 919bbc72bd..197bfe5f05 100644 --- a/libavcodec/aasc.c +++ b/libavcodec/aasc.c @@ -79,8 +79,13 @@ static int aasc_decode_frame(AVCodecContext *avctx, case 0: stride = (avctx->width * 3 + 3) & ~3; for(i = avctx->height - 1; i >= 0; i--){ + if(avctx->width*3 > buf_size){ + av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n"); + break; + } memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3); buf += stride; + buf_size -= stride; } break; case 1: |