diff options
| author | Laurent Aimar <fenrir@via.ecp.fr> | 2010-01-28 23:49:46 +0000 |
|---|---|---|
| committer | Aurelien Jacobs <aurel@gnuage.org> | 2010-01-28 23:49:46 +0000 |
| commit | 68a4d3498f28eff3508595283074e1ed8493879d (patch) | |
| tree | 45abbebdb73b286704f12f0fe9a6cfd7d6b987c7 /libavcodec/vp56.c | |
| parent | 8be0a5c384a26936cf070fb20bffcc6a1a130e1f (diff) | |
vp56: check buffer size to fix a potential segfault
patch by Laurent Aimar fenrir _at_ videolan _dot_ org
Originally committed as revision 21521 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/vp56.c')
| -rw-r--r-- | libavcodec/vp56.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/vp56.c b/libavcodec/vp56.c index cbac71bc93..36027b43f1 100644 --- a/libavcodec/vp56.c +++ b/libavcodec/vp56.c @@ -504,8 +504,12 @@ int vp56_decode_frame(AVCodecContext *avctx, void *data, int *data_size, int is_alpha, av_uninit(alpha_offset); if (s->has_alpha) { + if (remaining_buf_size < 3) + return -1; alpha_offset = bytestream_get_be24(&buf); remaining_buf_size -= 3; + if (remaining_buf_size < alpha_offset) + return -1; } for (is_alpha=0; is_alpha < 1+s->has_alpha; is_alpha++) { |