generic-library/vpx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit 'fix integer promotion bug in partition size check'

Browse Source 
Change-Id: I4081917b46013fa8f4218cade8bd12cb2d013aee
This commit is contained in:
John Koleszar
2010-11-05 16:49:17 -04:00
parent 5551ef0ef4 9fb80f7170
commit 4d1b0d2a2d
2 changed files with 12 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
vp8/decoder/decodframe.c
View File

@@ -461,7 +461,8 @@ static void setup_token_decoder(VP8D_COMP *pbi,
partition_size = user_data_end - partition;
}
if (user_data_end - partition < partition_size)
if (partition + partition_size > user_data_end
|| partition + partition_size < partition)
vpx_internal_error(&pc->error, VPX_CODEC_CORRUPT_FRAME,
"Truncated packet or corrupt partition "
"%d length", i + 1);
@@ -580,7 +581,8 @@ int vp8_decode_frame(VP8D_COMP *pbi)
(data[0] | (data[1] << 8) | (data[2] << 16)) >> 5;
data += 3;
if (data_end - data < first_partition_length_in_bytes)
if (data + first_partition_length_in_bytes > data_end
|| data + first_partition_length_in_bytes < data)
vpx_internal_error(&pc->error, VPX_CODEC_CORRUPT_FRAME,
"Truncated packet or corrupt partition 0 length");
vp8_setup_version(pc);