From b1096b6ee7d51c8e2b900af375b3f14194241ac2 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 15 Apr 2012 15:36:38 +0200 Subject: xan: check for vector_segment overread Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/xan.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavcodec/xan.c') diff --git a/libavcodec/xan.c b/libavcodec/xan.c index cfaca81e16..155dee9595 100644 --- a/libavcodec/xan.c +++ b/libavcodec/xan.c @@ -288,6 +288,7 @@ static int xan_wc3_decode_frame(XanContext *s) { const unsigned char *size_segment; const unsigned char *vector_segment; const unsigned char *imagedata_segment; + const unsigned char *buf_end = s->buf + s->size; int huffman_offset, size_offset, vector_offset, imagedata_offset, imagedata_size; @@ -392,6 +393,10 @@ static int xan_wc3_decode_frame(XanContext *s) { imagedata_size -= size; } } else { + if (vector_segment >= buf_end) { + av_log(s->avctx, AV_LOG_ERROR, "vector_segment overread\n"); + return AVERROR_INVALIDDATA; + } /* run-based motion compensation from last frame */ motion_x = sign_extend(*vector_segment >> 4, 4); motion_y = sign_extend(*vector_segment & 0xF, 4); -- cgit v1.2.3