Mercurial > libavcodec.hg
comparison smacker.c @ 3303:68721b62a528 libavcodec
sanity checks, some might have been exploitable ...
| author | michael |
|---|---|
| date | Sat, 13 May 2006 10:45:26 +0000 |
| parents | a931984ec6ab |
| children | 48fc664f7348 |
comparison
equal
deleted
inserted
replaced
| 3302:cb356bfc7e22 | 3303:68721b62a528 |
|---|---|
| 174 HuffContext huff; | 174 HuffContext huff; |
| 175 HuffContext tmp1, tmp2; | 175 HuffContext tmp1, tmp2; |
| 176 VLC vlc[2]; | 176 VLC vlc[2]; |
| 177 int escapes[3]; | 177 int escapes[3]; |
| 178 DBCtx ctx; | 178 DBCtx ctx; |
| 179 | |
| 180 if(size >= UINT_MAX>>4){ // (((size + 3) >> 2) + 3) << 2 must not overflow | |
| 181 av_log(smk->avctx, AV_LOG_ERROR, "size too large\n"); | |
| 182 return -1; | |
| 183 } | |
| 179 | 184 |
| 180 tmp1.length = 256; | 185 tmp1.length = 256; |
| 181 tmp1.maxlength = 0; | 186 tmp1.maxlength = 0; |
| 182 tmp1.current = 0; | 187 tmp1.current = 0; |
| 183 tmp1.bits = av_mallocz(256 * 4); | 188 tmp1.bits = av_mallocz(256 * 4); |