diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2011-08-20 15:13:01 +0400 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2011-08-21 18:34:35 +0400 |
| commit | 18de79692c1d8a5577fda16261a217f6d21dd867 (patch) | |
| tree | b4e284285fa5488a68d3f2219cde630d714ad926 /libavcodec/roqvideodec.c | |
| parent | ff96098084542c3ef98b360f70583999433d13a7 (diff) | |
roqvideodec: Improve checking of input buffer bounds.
Fixes trac issue #408.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Diffstat (limited to 'libavcodec/roqvideodec.c')
| -rw-r--r-- | libavcodec/roqvideodec.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/libavcodec/roqvideodec.c b/libavcodec/roqvideodec.c index 4af7ede9ad..f0c3ebb8d9 100644 --- a/libavcodec/roqvideodec.c +++ b/libavcodec/roqvideodec.c @@ -71,9 +71,17 @@ static void roqvideo_decode_frame(RoqContext *ri) } bpos = xpos = ypos = 0; + if (chunk_size > buf_end - buf) { + av_log(ri->avctx, AV_LOG_ERROR, "Chunk does not fit in input buffer\n"); + chunk_size = buf_end - buf; + } while(bpos < chunk_size) { for (yp = ypos; yp < ypos + 16; yp += 8) for (xp = xpos; xp < xpos + 16; xp += 8) { + if (bpos >= chunk_size) { + av_log(ri->avctx, AV_LOG_ERROR, "Input buffer too small\n"); + return; + } if (vqflg_pos < 0) { vqflg = buf[bpos++]; vqflg |= (buf[bpos++] << 8); vqflg_pos = 7; @@ -103,6 +111,10 @@ static void roqvideo_decode_frame(RoqContext *ri) if(k & 0x01) x += 4; if(k & 0x02) y += 4; + if (bpos >= chunk_size) { + av_log(ri->avctx, AV_LOG_ERROR, "Input buffer too small\n"); + return; + } if (vqflg_pos < 0) { vqflg = buf[bpos++]; vqflg |= (buf[bpos++] << 8); |