diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-05-28 16:50:15 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-06-09 21:06:12 +0200 |
| commit | 0aefcb6aa86b80729b2475d192940801892d97ff (patch) | |
| tree | eec5e5a436b99d5fa8cdbd917a0874a74f877ed0 | |
| parent | 64bc5f3bf75f6f009b66ba113da4afd1e7625d22 (diff) | |
| download | ffmpeg-0aefcb6aa86b80729b2475d192940801892d97ff.tar.gz | |
cdgraphics: Fix out of array write
Fixes Ticket1359
Found-by: Piotr Bandurski <ami_stuff@o2.pl>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 1e5c7376c4ed733910845c9a09e272ac7696b1f4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/cdgraphics.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c index aae7bbbb1b..3edeefc6d7 100644 --- a/libavcodec/cdgraphics.c +++ b/libavcodec/cdgraphics.c @@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx, av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n"); return AVERROR(EINVAL); } + if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) { + av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n"); + return AVERROR(EINVAL); + } ret = avctx->reget_buffer(avctx, &cc->frame); if (ret) { |