generic-library/vpx
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

vp9_dx_iface: subtract ptrs to validate frame_size

Browse Source 
Change-Id: Ic5a6a4a2fec802d9c9c7a71dbae59d5b4d3a8b23
This commit is contained in:
James Zern 2014-05-08 20:20:20 -07:00
parent 4aa7691225
commit a8cfbbe33f
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
vp9/vp9_dx_iface.c
View File

@ -417,7 +417,8 @@ static vpx_codec_err_t decoder_decode(vpx_codec_alg_priv_t *ctx,
for (i = 0; i < frame_count; ++i) {
const uint32_t frame_size = frame_sizes[i];
if (data_start < data || data_start + frame_size >= data_end) {
if (data_start < data ||
frame_size > (uint32_t)(data_end - data_start)) {
ctx->base.err_detail = "Invalid frame size in index";
return VPX_CODEC_CORRUPT_FRAME;
}