Module: libav Branch: release/9 Commit: f06e39fe6b272a11782c023c31eec43bfce3138d
Author: Martin Storsjö <[email protected]> Committer: Luca Barbato <[email protected]> Date: Sun Sep 29 01:24:20 2013 +0300 rpza: Fix a buffer size check We read 2 bytes for 15 out of 16 pixels, therefore we need to have at least 30 bytes, not 16. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] Signed-off-by: Martin Storsjö <[email protected]> (cherry picked from commit 7ba0cedbfeff5671b264d1d7e90777057b5714c6) Signed-off-by: Luca Barbato <[email protected]> --- libavcodec/rpza.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/rpza.c b/libavcodec/rpza.c index 57d4d2d..59b15c6 100644 --- a/libavcodec/rpza.c +++ b/libavcodec/rpza.c @@ -203,7 +203,7 @@ static void rpza_decode_stream(RpzaContext *s) /* Fill block with 16 colors */ case 0x00: - if (s->size - stream_ptr < 16) + if (s->size - stream_ptr < 30) return; block_ptr = row_ptr + pixel_ptr; for (pixel_y = 0; pixel_y < 4; pixel_y++) { _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
