summaryrefslogtreecommitdiff
path: root/libavcodec/truemotion1.c
diff options
context:
space:
mode:
authorAnton Khirnov <anton@khirnov.net>2013-11-28 10:54:35 +0100
committerAnton Khirnov <anton@khirnov.net>2014-02-04 22:00:13 +0100
commit2240e2078d53d3cfce8ff1dda64e58fa72038602 (patch)
tree64864719067430e51aa036e822fa279d6f9ffc1a /libavcodec/truemotion1.c
parent1713eec29add37b654ec6bf262b843d139c1ffc6 (diff)
downloadffmpeg-2240e2078d53d3cfce8ff1dda64e58fa72038602.tar.gz
truemotion1: check the header size
Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
Diffstat (limited to 'libavcodec/truemotion1.c')
-rw-r--r--libavcodec/truemotion1.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c
index b1497d5011..270a030c33 100644
--- a/libavcodec/truemotion1.c
+++ b/libavcodec/truemotion1.c
@@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
return AVERROR_INVALIDDATA;
}
+ if (header.header_size + 1 > s->size) {
+ av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
+ return AVERROR_INVALIDDATA;
+ }
+
/* unscramble the header bytes with a XOR operation */
for (i = 1; i < header.header_size; i++)
header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];