diff options
author | Luca Barbato <lu_zero@gentoo.org> | 2014-06-20 01:26:58 +0400 |
---|---|---|
committer | Luca Barbato <lu_zero@gentoo.org> | 2014-06-23 12:20:57 +0400 |
commit | ccda51b14c0fcae2fad73a24872dce75a7964996 (patch) | |
tree | 420498f29b627ee08e0e58375da3a7ec5fc93cbc | |
parent | e121ac634ba324a318f4a97f978dcfb48da6b735 (diff) |
lzo: Handle integer overflow
get_len can overflow for specially crafted payload.
Reported-By: Don A. Baley <donb@securitymouse.com>
CC: libav-stable@libav.org
-rw-r--r-- | libavutil/lzo.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/libavutil/lzo.c b/libavutil/lzo.c index 5c5ebc850a..e458165261 100644 --- a/libavutil/lzo.c +++ b/libavutil/lzo.c @@ -80,6 +80,10 @@ static inline void copy(LZOContext *c, int cnt) { register const uint8_t *src = c->in; register uint8_t *dst = c->out; + if (cnt < 0) { + c->error |= AV_LZO_ERROR; + return; + } if (cnt > c->in_end - src) { cnt = FFMAX(c->in_end - src, 0); c->error |= AV_LZO_INPUT_DEPLETED; @@ -103,7 +107,7 @@ static inline void copy(LZOContext *c, int cnt) /** * @brief Copies previously decoded bytes to current position. * @param back how many bytes back we start - * @param cnt number of bytes to copy, must be >= 0 + * @param cnt number of bytes to copy, must be > 0 * * cnt > back is valid, this will copy the bytes we just copied, * thus creating a repeating pattern with a period length of back. @@ -111,6 +115,10 @@ static inline void copy(LZOContext *c, int cnt) static inline void copy_backptr(LZOContext *c, int back, int cnt) { register uint8_t *dst = c->out; + if (cnt <= 0) { + c->error |= AV_LZO_ERROR; + return; + } if (dst - c->out_start < back) { c->error |= AV_LZO_INVALID_BACKPTR; return; |