summaryrefslogtreecommitdiff
path: root/libavcodec/eacmv.c
diff options
context:
space:
mode:
authorLaurent Aimar <fenrir@videolan.org>2011-09-30 23:42:32 +0000
committerJanne Grunau <janne-libav@jannau.net>2011-10-10 21:36:13 +0200
commit46cb2f6a2928a7fa4bee3f09b0475ccb8cdd2064 (patch)
tree4f79ca92e356bf34758e8841bf3beece5120857e /libavcodec/eacmv.c
parent8df8a87e3fd5bd0c3dabc676aae8fd84992932dc (diff)
downloadffmpeg-46cb2f6a2928a7fa4bee3f09b0475ccb8cdd2064.tar.gz
eacmv: check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Diffstat (limited to 'libavcodec/eacmv.c')
-rw-r--r--libavcodec/eacmv.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c
index 0a146f5347..085e2d8177 100644
--- a/libavcodec/eacmv.c
+++ b/libavcodec/eacmv.c
@@ -153,6 +153,9 @@ static int cmv_decode_frame(AVCodecContext *avctx,
CmvContext *s = avctx->priv_data;
const uint8_t *buf_end = buf + buf_size;
+ if (buf_end - buf < EA_PREAMBLE_SIZE)
+ return AVERROR_INVALIDDATA;
+
if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) {
cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end);
return buf_size;