diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-20 00:48:53 +0400 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2011-12-24 15:20:33 +0400 |
| commit | da0900e8bba8d39b022add6eb8cd1857a344c405 (patch) | |
| tree | adee97ba88c1bf75b5f6f4aa7bc65eca9d23c738 /libavcodec | |
| parent | d5551d788444872deb62101b7a52e335c87db69a (diff) | |
rv34: Check for invalid slice offsets
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4cc7732386eb36661ed22d1200339b38a5fa60bc)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2bbb142a140173e1870017b66c439f4d430a6f67)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/rv34.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c index 8d5f4f7e3e..e6fa3cfd8f 100644 --- a/libavcodec/rv34.c +++ b/libavcodec/rv34.c @@ -1444,8 +1444,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, slice_count = avctx->slice_count; //parse first slice header to check whether this frame can be decoded - if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){ - av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); + if(get_slice_offset(avctx, slices_hdr, 0) < 0 || + get_slice_offset(avctx, slices_hdr, 0) > buf_size){ + av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); return -1; } init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0)); @@ -1473,8 +1474,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, else size= get_slice_offset(avctx, slices_hdr, i+1) - offset; - if(offset > buf_size){ - av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); + if(offset < 0 || offset > buf_size || size < 0){ + av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); break; } |