generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

aascdec: Check input buffer size on raw data.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2011-12-13 15:45:04 +01:00
parent a6c4c0f274
commit be5db7004f
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/aasc.c
View File

@ -79,8 +79,13 @@ static int aasc_decode_frame(AVCodecContext *avctx,
case 0: case 0:
stride = (avctx->width * 3 + 3) & ~3; stride = (avctx->width * 3 + 3) & ~3;
for(i = avctx->height - 1; i >= 0; i--){ for(i = avctx->height - 1; i >= 0; i--){
if(avctx->width*3 > buf_size){
av_log(avctx, AV_LOG_ERROR, "Next line is beyond buffer bounds\n");
break;
}
memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3); memcpy(s->frame.data[0] + i*s->frame.linesize[0], buf, avctx->width*3);
buf += stride; buf += stride;
buf_size -= stride;
} }
break; break;
case 1: case 1: