diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-07-10 16:54:51 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-07-10 18:11:28 +0200 |
| commit | b1e242bc565665420661e016127fe07b4b615ecb (patch) | |
| tree | 1c9bfd029c2dc541e6459684fe88ece100a0d6a0 /libavcodec/g2meet.c | |
| parent | 3526a120f92929cb0a4009e403ee2f141030c487 (diff) | |
avcodec/g2meet: Check R/G/B values in epic_decode_pixel_pred()
Fixes: asan_double-free_d34593_861_smp3.wmv
Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/g2meet.c')
| -rw-r--r-- | libavcodec/g2meet.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index b952adbb17..22efd7583a 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -555,6 +555,11 @@ static uint32_t epic_decode_pixel_pred(ePICContext *dc, int x, int y, B = ((pred >> B_shift) & 0xFF) - TOSIGNED(delta); } + if (R<0 || G<0 || B<0) { + av_log(NULL, AV_LOG_ERROR, "RGB %d %d %d is out of range\n", R, G, B); + return 0; + } + return (R << R_shift) | (G << G_shift) | (B << B_shift); } |