From 46adcc27a218d381fa23ea247f1dd4bc6a60e885 Mon Sep 17 00:00:00 2001 From: Reimar Döffinger Date: Sun, 31 May 2009 09:59:46 +0000 Subject: Add sanity check for mthread_inlen, avoids crashes due to invalid reads. Originally committed as revision 19042 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/lcldec.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'libavcodec/lcldec.c') diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c index bfb2150f88..5593567500 100644 --- a/libavcodec/lcldec.c +++ b/libavcodec/lcldec.c @@ -190,6 +190,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac case COMP_MSZH: if (c->flags & FLAG_MULTITHREAD) { mthread_inlen = *(unsigned int*)encoded; + mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size); @@ -236,6 +237,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac if (c->flags & FLAG_MULTITHREAD) { int ret; mthread_inlen = *(unsigned int*)encoded; + mthread_inlen = FFMIN(mthread_inlen, len - 8); mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen); -- cgit v1.2.3