diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 00:33:42 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-04 00:33:42 +0200 |
| commit | 7d82020fcb7f81fcbbd30b7546ba62af45f1a33c (patch) | |
| tree | 16504cac144fc1a8adf7822c642bb27a4c20c427 /libavcodec/bmv.c | |
| parent | e10eac910a2df9a2a37f13a1a0876698b240f334 (diff) | |
| parent | 19dfbf1915a0739f1a8b2f5a56aa1d3ff0597d9c (diff) | |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
librtmp: return AVERROR_UNKNOWN instead of -1.
librtmp: don't abuse a variable for two unrelated things.
librtmp: add rtmp_app and rtmp_playpath private options.
bmv: add stricter checks for invalid decoded length
avpacket: fix duplicating side data.
flv: support stream text data as onTextData
Conflicts:
libavcodec/bmv.c
libavformat/flvdec.c
libavformat/flvenc.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/bmv.c')
| -rw-r--r-- | libavcodec/bmv.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c index 35923a28d6..d06ebae7e0 100644 --- a/libavcodec/bmv.c +++ b/libavcodec/bmv.c @@ -143,16 +143,20 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame, switch (mode) { case 1: if (forward) { - if (dst - frame + SCREEN_WIDE < -frame_off || - frame_end - dst < frame_off + len) + if (dst - frame + SCREEN_WIDE < frame_off || + dst - frame + SCREEN_WIDE + frame_off < 0 || + frame_end - dst < frame_off + len || + frame_end - dst < len) return -1; for (i = 0; i < len; i++) dst[i] = dst[frame_off + i]; dst += len; } else { dst -= len; - if (dst - frame + SCREEN_WIDE < -frame_off || - frame_end - dst < frame_off + len) + if (dst - frame + SCREEN_WIDE < frame_off || + dst - frame + SCREEN_WIDE + frame_off < 0 || + frame_end - dst < frame_off + len || + frame_end - dst < len) return -1; for (i = len - 1; i >= 0; i--) dst[i] = dst[frame_off + i]; |