diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 18:50:15 +0400 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 19:26:16 +0400 |
| commit | 0f9098cb187dd080f4aa58d608de1515dca95134 (patch) | |
| tree | 5904b12ea3806cedb0ef579638094f6c0bae5001 /libavcodec | |
| parent | c4e3dd06e8fa12582ec459181fcbd047687f2861 (diff) | |
cdgraphics: Fix out of array write
Fixes Ticket1359
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e5c7376c4ed733910845c9a09e272ac7696b1f4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index d0cc2126ef..d7b85100ae 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n"); return AVERROR(EINVAL); } + if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) { + av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n"); + return AVERROR(EINVAL); + } ret = avctx->reget_buffer(avctx, &cc->frame); if (ret) { |