From 44c4170c52c10e3da3a7ea8e3435ef37c4edc2cc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Sun, 15 Apr 2012 18:13:50 +0200
Subject: lzw: check for overread

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
 libavcodec/lzw.c | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'libavcodec')

diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c
index 348d2de06b..19f3e110f4 100644
--- a/libavcodec/lzw.c
+++ b/libavcodec/lzw.c
@@ -190,6 +190,10 @@ int ff_lzw_decode(LZWState *p, uint8_t *buf, int len){
             if ((--l) == 0)
                 goto the_end;
         }
+        if (s->ebuf < s->pbuf) {
+            av_log(0, AV_LOG_ERROR, "lzw overread\n");
+            goto the_end;
+        }
         c = lzw_get_code(s);
         if (c == s->end_code) {
             break;
-- 
cgit v1.2.3