diff options
| author | Laurent Aimar <fenrir@videolan.org> | 2011-09-30 23:42:32 +0000 |
|---|---|---|
| committer | Janne Grunau <janne-libav@jannau.net> | 2011-10-10 21:36:13 +0200 |
| commit | 46cb2f6a2928a7fa4bee3f09b0475ccb8cdd2064 (patch) | |
| tree | 4f79ca92e356bf34758e8841bf3beece5120857e /libavcodec/eacmv.c | |
| parent | 8df8a87e3fd5bd0c3dabc676aae8fd84992932dc (diff) | |
| download | ffmpeg-46cb2f6a2928a7fa4bee3f09b0475ccb8cdd2064.tar.gz | |
eacmv: check for out of bound reads
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
Diffstat (limited to 'libavcodec/eacmv.c')
| -rw-r--r-- | libavcodec/eacmv.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/eacmv.c b/libavcodec/eacmv.c index 0a146f5347..085e2d8177 100644 --- a/libavcodec/eacmv.c +++ b/libavcodec/eacmv.c @@ -153,6 +153,9 @@ static int cmv_decode_frame(AVCodecContext *avctx, CmvContext *s = avctx->priv_data; const uint8_t *buf_end = buf + buf_size; + if (buf_end - buf < EA_PREAMBLE_SIZE) + return AVERROR_INVALIDDATA; + if (AV_RL32(buf)==MVIh_TAG||AV_RB32(buf)==MVIh_TAG) { cmv_process_header(s, buf+EA_PREAMBLE_SIZE, buf_end); return buf_size; |