diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-25 00:08:51 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-09-25 00:42:42 +0200 |
| commit | 35cb6854bb76b4a5b6f2aea2dce81e18d7ab61cd (patch) | |
| tree | 97fce12947149094860c8889bf9d364510eee875 /libavcodec/vmdav.c | |
| parent | 4749e074987d45cb98935a683a7ee8e1ee376d86 (diff) | |
Fix potential pointer arithmetic overflows in rle_unpack() of vmd video decoder.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/vmdav.c')
| -rw-r--r-- | libavcodec/vmdav.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/vmdav.c b/libavcodec/vmdav.c index 98bd485c3e..6729af6af7 100644 --- a/libavcodec/vmdav.c +++ b/libavcodec/vmdav.c @@ -179,13 +179,13 @@ static int rle_unpack(const unsigned char *src, int src_len, int src_count, l = *ps++; if (l & 0x80) { l = (l & 0x7F) * 2; - if (pd + l > dest_end || ps_end - ps < l) + if (dest_end - pd < l || ps_end - ps < l) return ps - src; memcpy(pd, ps, l); ps += l; pd += l; } else { - if (pd + i > dest_end || ps_end - ps < 2) + if (dest_end - pd < i || ps_end - ps < 2) return ps - src; for (i = 0; i < l; i++) { *pd++ = ps[0]; |