diff options
| author | Anton Khirnov <anton@khirnov.net> | 2013-11-28 13:54:35 +0400 |
|---|---|---|
| committer | Anton Khirnov <anton@khirnov.net> | 2014-01-03 19:38:36 +0400 |
| commit | 5569146d48f06564e8fa393424782cceed510916 (patch) | |
| tree | df0c705cf95c83826a5410f82a43e56e78a0a360 /libavcodec/adx.c | |
| parent | a6a2282c25abe43e352010a7c3fbc92994c0bc1c (diff) | |
adx: check that the offset is not negative
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
Diffstat (limited to 'libavcodec/adx.c')
| -rw-r--r-- | libavcodec/adx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/adx.c b/libavcodec/adx.c index 63358650ed..a9cf4ffd09 100644 --- a/libavcodec/adx.c +++ b/libavcodec/adx.c @@ -48,7 +48,7 @@ int avpriv_adx_decode_header(AVCodecContext *avctx, const uint8_t *buf, offset = AV_RB16(buf + 2) + 4; /* if copyright string is within the provided data, validate it */ - if (bufsize >= offset && memcmp(buf + offset - 6, "(c)CRI", 6)) + if (bufsize >= offset && offset >= 6 && memcmp(buf + offset - 6, "(c)CRI", 6)) return AVERROR_INVALIDDATA; /* check for encoding=3 block_size=18, sample_size=4 */ |