diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2008-05-04 00:56:57 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2008-05-04 00:56:57 +0400 |
commit | 83e9a67d7c76b12ca614709f451a2a175cd48721 (patch) | |
tree | 509d0d9b5ae613420972db9c1ea85894be416142 /libavcodec/alac.c | |
parent | 3df9ce75b5f333dd760fd43feeba7daa5ae23d56 (diff) |
Fix memset(0) based buffer overflow.
Originally committed as revision 13050 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/alac.c')
-rw-r--r-- | libavcodec/alac.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/libavcodec/alac.c b/libavcodec/alac.c index 648b4b6f19..9fbba9544a 100644 --- a/libavcodec/alac.c +++ b/libavcodec/alac.c @@ -199,7 +199,8 @@ static void bastardized_rice_decompress(ALACContext *alac, /* special case: there may be compressed blocks of 0 */ if ((history < 128) && (output_count+1 < output_size)) { - int block_size, k; + int k; + unsigned int block_size; sign_modifier = 1; @@ -208,6 +209,10 @@ static void bastardized_rice_decompress(ALACContext *alac, block_size= decode_scalar(&alac->gb, k, rice_kmodifier, 16); if (block_size > 0) { + if(block_size >= output_size - output_count){ + av_log(alac->avctx, AV_LOG_ERROR, "invalid zero block size of %d %d %d\n", block_size, output_size, output_count); + block_size= output_size - output_count - 1; + } memset(&output_buffer[output_count+1], 0, block_size * 4); output_count += block_size; } |