Module: libav Branch: release/9 Commit: 95275723aee38ee841706e667d09ca9f325e634b
Author: Luca Barbato <[email protected]> Committer: Luca Barbato <[email protected]> Date: Fri Jul 19 21:09:40 2013 +0200 dsicinav: Bound-check the source buffer when needed Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] (cherry picked from commit dd0bfc3a6a310e3e3674ce7742672d689a9a0e93) Signed-off-by: Luca Barbato <[email protected]> --- libavcodec/dsicinav.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/libavcodec/dsicinav.c b/libavcodec/dsicinav.c index df81c58..7f5c1da 100644 --- a/libavcodec/dsicinav.c +++ b/libavcodec/dsicinav.c @@ -196,11 +196,13 @@ static void cin_decode_rle(const unsigned char *src, int src_size, while (src < src_end && dst < dst_end) { code = *src++; if (code & 0x80) { + if (src >= src_end) + break; len = code - 0x7F; memset(dst, *src++, FFMIN(len, dst_end - dst)); } else { len = code + 1; - memcpy(dst, src, FFMIN(len, dst_end - dst)); + memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src)); src += len; } dst += len; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
