generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

wavpack: check pointer to avoid overreading input buffer

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-11 16:36:52 +01:00
parent 85a4dbeb9c
commit 8d06be6b8c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/wavpack.c
View File

@ -906,7 +906,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
continue;
}
t = 0;
for (i = s->terms - 1; (i >= 0) && (t < size); i--) {
for (i = s->terms - 1; (i >= 0) && (t < size) && buf <= buf_end; i--) {
if (s->decorr[i].value > 8) {
s->decorr[i].samplesA[0] = wp_exp2(AV_RL16(buf)); buf += 2;
s->decorr[i].samplesA[1] = wp_exp2(AV_RL16(buf)); buf += 2;
@ -921,7 +921,7 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
s->decorr[i].samplesB[0] = wp_exp2(AV_RL16(buf)); buf += 2;
t += 4;
} else {
for (j = 0; j < s->decorr[i].value; j++) {
for (j = 0; j < s->decorr[i].value && buf+1<buf_end; j++) {
s->decorr[i].samplesA[j] = wp_exp2(AV_RL16(buf)); buf += 2;
if (s->stereo_in) {
s->decorr[i].samplesB[j] = wp_exp2(AV_RL16(buf)); buf += 2;