Validate the calculated index against both the current position and the total texture size to prevent out-of-bounds memory access.
Signed-off-by: 0xBat <[email protected]> --- libavcodec/dxv.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/libavcodec/dxv.c b/libavcodec/dxv.c index 07eee253e7..8d11dfe1a1 100644 --- a/libavcodec/dxv.c +++ b/libavcodec/dxv.c @@ -72,8 +72,8 @@ typedef struct DXVContext { idx = x; \ break; \ case 2: \ - idx = (bytestream2_get_byte(gbc) + 2) * x; \ - if (idx > pos) { \ + idx = (bytestream2_get_byte(gbc) + 2) * x; + if (idx > pos || idx > ctx->tex_size) { \ av_log(avctx, AV_LOG_ERROR, "idx %d > %d\n", idx, pos); \ return AVERROR_INVALIDDATA; \ } \ -- 2.52.0.windows.1 _______________________________________________ ffmpeg-devel mailing list -- [email protected] To unsubscribe send an email to [email protected]
