diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 22:29:08 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 22:29:27 +0400 |
commit | abe68364a3219f1a98c46bddea575e4cada147c7 (patch) | |
tree | 4be5eaf891a601d5050dad3262c437958b0ed338 /libavformat/swfdec.c | |
parent | d1493d2ce5f598016adff8cda8484529a560fb0d (diff) |
swfdec: check space before copy
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/swfdec.c')
-rw-r--r-- | libavformat/swfdec.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavformat/swfdec.c b/libavformat/swfdec.c index b8c2e930c3..193df25e2f 100644 --- a/libavformat/swfdec.c +++ b/libavformat/swfdec.c @@ -362,6 +362,11 @@ static int swf_read_packet(AVFormatContext *s, AVPacket *pkt) default: av_assert0(0); } + + if (linesize * height > pkt->size) { + res = AVERROR_INVALIDDATA; + goto bitmap_end; + } memcpy(pkt->data, buf + colormapsize*colormapbpp, linesize * height); res = pkt->size; |