diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-10-03 18:06:23 +0400 |
---|---|---|
committer | Justin Ruggles <justin.ruggles@gmail.com> | 2012-12-08 01:15:02 +0400 |
commit | 096abfa15052977eed93f0b5e01afd2d47c53c1f (patch) | |
tree | 4bece1a3049de0b0c411a46efe22f4f1900808c4 /libavcodec | |
parent | 41540b36a19d326e778268e910aff4217b20eb97 (diff) |
parser: fix large overreads
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Justin Ruggles <justin.ruggles@gmail.com>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/parser.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavcodec/parser.c b/libavcodec/parser.c index 7ace766eb9..0767a34959 100644 --- a/libavcodec/parser.c +++ b/libavcodec/parser.c @@ -254,7 +254,9 @@ int ff_combine_frame(ParseContext *pc, int next, const uint8_t **buf, int *buf_s if(!new_buffer) return AVERROR(ENOMEM); pc->buffer = new_buffer; - memcpy(&pc->buffer[pc->index], *buf, next + FF_INPUT_BUFFER_PADDING_SIZE ); + if (next > -FF_INPUT_BUFFER_PADDING_SIZE) + memcpy(&pc->buffer[pc->index], *buf, + next + FF_INPUT_BUFFER_PADDING_SIZE); pc->index = 0; *buf= pc->buffer; } |