generic-library/vpx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix incorrect size reading

Browse Source 
Cherry pick from vp9:

commit 85770264ac891505730dcd5092d1993a62c74060
Guard against incorrect size values moving *data past data_end.

Check read length against the difference of the buffers.

Change-Id: I5e8679ddd447c4d73deb80be5ec94841a92c5fcd
This commit is contained in:
Johann 2018-01-26 15:50:50 -08:00
parent a9bbff1049
commit 738b829b8c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
vp8/decoder/decodeframe.c
View File

@ -674,7 +674,7 @@ static unsigned int read_partition_size(VP8D_COMP *pbi,
static int read_is_valid(const unsigned char *start, size_t len,
const unsigned char *end) {
return (start + len > start && start + len <= end);
return len != 0 && len <= (size_t)(end - start);
}
static unsigned int read_available_partition_size(