From 53be37e368928e7f274e33ef8d118109da373c79 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Tue, 13 Dec 2011 15:45:43 +0100 Subject: msrledec: Check for overreads Signed-off-by: Michael Niedermayer --- libavcodec/msrledec.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'libavcodec/msrledec.c') diff --git a/libavcodec/msrledec.c b/libavcodec/msrledec.c index db8de7032d..129f0e0bc0 100644 --- a/libavcodec/msrledec.c +++ b/libavcodec/msrledec.c @@ -140,7 +140,7 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de output = pic->data[0] + (avctx->height - 1) * pic->linesize[0]; output_end = pic->data[0] + avctx->height * pic->linesize[0]; - while(src < data + srcsize) { + while(src + 1 < data + srcsize) { p1 = *src++; if(p1 == 0) { //Escape code p2 = *src++; @@ -172,6 +172,10 @@ static int msrle_decode_8_16_24_32(AVCodecContext *avctx, AVPicture *pic, int de src += p2 * (depth >> 3); continue; } + if(data + srcsize - src < p2 * (depth >> 3)){ + av_log(avctx, AV_LOG_ERROR, "Copy beyond input buffer\n"); + return -1; + } if ((depth == 8) || (depth == 24)) { for(i = 0; i < p2 * (depth >> 3); i++) { *output++ = *src++; -- cgit v1.2.1