From 68eb20801d6929974feb41219290cb4c207cdf59 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 5 Jan 2016 03:08:09 +0100 Subject: avcodec/dxv: Check idx in dxv_decompress_dxt5() Fixes potential out of array read No testcase available Signed-off-by: Michael Niedermayer --- libavcodec/dxv.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'libavcodec/dxv.c') diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index f1ea2987ae..05a9aadd24 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -260,6 +260,10 @@ static int dxv_decompress_dxt5(AVCodecContext *avctx) case 2: /* Copy two dwords from a previous index */ idx = 8 + bytestream2_get_le16(gbc); + if (idx > pos) { + av_log(avctx, AV_LOG_ERROR, "idx %d > %d\n", idx, pos); + return AVERROR_INVALIDDATA; + } prev = AV_RL32(ctx->tex_data + 4 * (pos - idx)); AV_WL32(ctx->tex_data + 4 * pos, prev); pos++; -- cgit v1.2.3