diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-31 18:25:44 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-31 18:25:44 +0200 |
| commit | 3768445be80090f2c12afa5eb95152dcd389b616 (patch) | |
| tree | 88645c1c0cd6bdcc4047be630b897734b87f9d77 /libavcodec/truemotion2.c | |
| parent | f9143d2407b38f33b85487fd597c9194f79adb20 (diff) | |
tm2dec: fix overread
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/truemotion2.c')
| -rw-r--r-- | libavcodec/truemotion2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index c4f66e8f6d..8f091e7871 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -272,7 +272,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i if(len == 0) return 4; - if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) { + if (len >= INT_MAX/4-1 || len < 0 || skip > buf_size) { av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n"); return -1; } |