diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-07-07 12:31:19 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-28 15:41:59 +0200 |
| commit | 62b1e3b1031e901105d78e831120de8e4c3e0013 (patch) | |
| tree | f164e639e6b4cb8e09f4c63e3e8728b54f5635e8 /libavcodec/aasc.c | |
| parent | 45ee556d51ef04d79d52bf6b0b7f28a4d231cb0c (diff) | |
aasc: Check minimum buffer size
Prevent some overreads.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/aasc.c')
| -rw-r--r-- | libavcodec/aasc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/aasc.c b/libavcodec/aasc.c index bce27c0e10..60a4be817b 100644 --- a/libavcodec/aasc.c +++ b/libavcodec/aasc.c @@ -62,6 +62,9 @@ static int aasc_decode_frame(AVCodecContext *avctx, AascContext *s = avctx->priv_data; int compr, i, stride, ret; + if (buf_size < 4) + return AVERROR_INVALIDDATA; + if ((ret = ff_reget_buffer(avctx, s->frame)) < 0) { av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n"); return ret; @@ -73,6 +76,8 @@ static int aasc_decode_frame(AVCodecContext *avctx, switch (compr) { case 0: stride = (avctx->width * 3 + 3) & ~3; + if (buf_size < stride * avctx->height) + return AVERROR_INVALIDDATA; for (i = avctx->height - 1; i >= 0; i--) { memcpy(s->frame->data[0] + i * s->frame->linesize[0], buf, avctx->width * 3); buf += stride; |