har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

truemotion2: Fix the buffer check

Browse Source 
The variable skip contains the expected size in bytes.

Bug-Id: 906
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Luca Barbato 2015-11-01 04:07:47 +01:00
parent 4a32692338
commit de41b555cd
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/truemotion2.c
View File

@ -291,7 +291,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
if (len == 0) if (len == 0)
return 4; return 4;
if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) { if (len >= INT_MAX / 4 - 1 || len < 0 || skip > buf_size) {
av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n"); av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }