From 0f9098cb187dd080f4aa58d608de1515dca95134 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 28 May 2012 16:50:15 +0200 Subject: cdgraphics: Fix out of array write Fixes Ticket1359 Found-by: Piotr Bandurski Signed-off-by: Michael Niedermayer (cherry picked from commit 1e5c7376c4ed733910845c9a09e272ac7696b1f4) Signed-off-by: Michael Niedermayer --- libavcodec/cdgraphics.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'libavcodec') diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index d0cc2126ef..d7b85100ae 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n"); return AVERROR(EINVAL); } + if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) { + av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n"); + return AVERROR(EINVAL); + } ret = avctx->reget_buffer(avctx, &cc->frame); if (ret) { -- cgit v1.2.3