diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2015-11-01 04:07:47 +0100 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2015-11-02 16:29:14 +0100 |
| commit | de41b555cdea2dcacbe98ee9edc83a8c15c73c4c (patch) | |
| tree | 6e06f994d7e965f67b2746837badc866a1dff45d /libavcodec/truemotion2.c | |
| parent | 4a326923381f2bc0fb7d960c8f8366a5456bc4ab (diff) | |
| download | ffmpeg-de41b555cdea2dcacbe98ee9edc83a8c15c73c4c.tar.gz | |
truemotion2: Fix the buffer check
The variable skip contains the expected size in bytes.
Bug-Id: 906
CC: libav-stable@libav.org
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec/truemotion2.c')
| -rw-r--r-- | libavcodec/truemotion2.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 84e8e2a9b3..172644007c 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -291,7 +291,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i if (len == 0) return 4; - if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) { + if (len >= INT_MAX / 4 - 1 || len < 0 || skip > buf_size) { av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n"); return AVERROR_INVALIDDATA; } |