From c8b835954ae4aef797112afda3b52f8dfe3c7b74 Mon Sep 17 00:00:00 2001 From: Laurent Aimar Date: Wed, 28 Sep 2011 00:45:54 +0200 Subject: Check for out of bound reads in xan_huffman_decode() of the xan decoder. Signed-off-by: Michael Niedermayer --- libavcodec/xan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libavcodec/xan.c') diff --git a/libavcodec/xan.c b/libavcodec/xan.c index fe11ac3f7a..21b5302000 100644 --- a/libavcodec/xan.c +++ b/libavcodec/xan.c @@ -114,7 +114,10 @@ static int xan_huffman_decode(unsigned char *dest, int dest_len, init_get_bits(&gb, ptr, ptr_len * 8); while ( val != 0x16 ) { - val = src[val - 0x17 + get_bits1(&gb) * byte]; + unsigned idx = val - 0x17 + get_bits1(&gb) * byte; + if (idx >= 2 * byte) + return -1; + val = src[idx]; if ( val < 0x16 ) { if (dest >= dest_end) -- cgit v1.2.3