diff options
author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-04-17 23:07:16 +0400 |
---|---|---|
committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-04-17 23:07:16 +0400 |
commit | 16cc5a738c31fdec1bdd6cadec8b30b825344e9f (patch) | |
tree | 888576c19311c43cab659db195a8ed7e3bb8be11 /libavcodec/xan.c | |
parent | c644665f42d12bd84c414b52f2d32833b14d2196 (diff) |
Fix buffer size check for xan_unpack which was broken by r18586
Originally committed as revision 18589 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/xan.c')
-rw-r--r-- | libavcodec/xan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/xan.c b/libavcodec/xan.c index f1e343e88d..04f2b1f249 100644 --- a/libavcodec/xan.c +++ b/libavcodec/xan.c @@ -156,7 +156,7 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l back = ((opcode & 0x10) << 12) + 1 + bytestream_get_be16(&src); size2 = *src++ + 5 + ((opcode & 0xc) << 6); - if (dest >= dest_end || size > dest_end - dest) + if (size + size2 > dest_end - dest) return; } memcpy(dest, src, size); dest += size; src += size; |