Module: libav
Branch: release/11
Commit: 446ba6e5890d663754c7de8c301b061217d262fd

Author:    Federico Tomassetti <[email protected]>
Committer: Luca Barbato <[email protected]>
Date:      Thu Aug 13 15:35:53 2015 +0200

vp7: bound checking in vp7_decode_frame_header

CC: [email protected]

---

 libavcodec/vp8.c |    8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libavcodec/vp8.c b/libavcodec/vp8.c
index 63c0ce7..fff0711 100644
--- a/libavcodec/vp8.c
+++ b/libavcodec/vp8.c
@@ -474,6 +474,10 @@ static int vp7_decode_frame_header(VP8Context *s, const 
uint8_t *buf, int buf_si
     int width  = s->avctx->width;
     int height = s->avctx->height;
 
+    if (buf_size < 4) {
+        return AVERROR_INVALIDDATA;
+    }
+
     s->profile = (buf[0] >> 1) & 7;
     if (s->profile > 1) {
         avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);
@@ -487,6 +491,10 @@ static int vp7_decode_frame_header(VP8Context *s, const 
uint8_t *buf, int buf_si
     buf      += 4 - s->profile;
     buf_size -= 4 - s->profile;
 
+    if (buf_size < part1_size) {
+        return AVERROR_INVALIDDATA;
+    }
+
     memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, 
sizeof(s->put_pixels_tab));
 
     ff_vp56_init_range_decoder(c, buf, part1_size);

_______________________________________________
libav-commits mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-commits

Reply via email to