har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/iff: Check that there are enough bytes in dgb before reading

Browse Source 
Fixes CID1361959

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-07-11 14:48:03 +02:00
parent 9585c50942
commit a2550e7d2e
1 changed files with 4 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/iff.c
View File

@ -1388,6 +1388,8 @@ static void decode_delta_l(uint8_t *dst,
offset = ((2 * offset) / planepitch_byte) * pitch + ((2 * offset) % planepitch_byte) + k * planepitch; offset = ((2 * offset) / planepitch_byte) * pitch + ((2 * offset) % planepitch_byte) + k * planepitch;
if (cnt < 0) { if (cnt < 0) {
if (bytestream2_get_bytes_left(&dgb) < 2)
break;
bytestream2_seek_p(&pb, offset, SEEK_SET); bytestream2_seek_p(&pb, offset, SEEK_SET);
cnt = -cnt; cnt = -cnt;
data = bytestream2_get_be16(&dgb); data = bytestream2_get_be16(&dgb);
@ -1396,6 +1398,8 @@ static void decode_delta_l(uint8_t *dst,
bytestream2_skip_p(&pb, dstpitch - 2); bytestream2_skip_p(&pb, dstpitch - 2);
} }
} else { } else {
if (bytestream2_get_bytes_left(&dgb) < 2*cnt)
break;
bytestream2_seek_p(&pb, offset, SEEK_SET); bytestream2_seek_p(&pb, offset, SEEK_SET);
for (i = 0; i < cnt; i++) { for (i = 0; i < cnt; i++) {
data = bytestream2_get_be16(&dgb); data = bytestream2_get_be16(&dgb);