Mercurial > libavcodec.hg
comparison lzo.c @ 4442:b514c50250f6 libavcodec
Add two extra needed bounds checks
| author | reimar |
|---|---|
| date | Wed, 31 Jan 2007 10:29:58 +0000 |
| parents | fdb91110889b |
| children | 54bed3ee58f3 |
comparison
equal
deleted
inserted
replaced
| 4441:fdb91110889b | 4442:b514c50250f6 |
|---|---|
| 180 if (x > 17) { | 180 if (x > 17) { |
| 181 copy(&c, x - 17); | 181 copy(&c, x - 17); |
| 182 x = GETB(c); | 182 x = GETB(c); |
| 183 if (x < 16) c.error |= LZO_ERROR; | 183 if (x < 16) c.error |= LZO_ERROR; |
| 184 } | 184 } |
| 185 if (c.in > c.in_end) | |
| 186 c.error |= LZO_INPUT_DEPLETED; | |
| 185 while (!c.error) { | 187 while (!c.error) { |
| 186 int cnt, back; | 188 int cnt, back; |
| 187 if (x > 15) { | 189 if (x > 15) { |
| 188 if (x > 63) { | 190 if (x > 63) { |
| 189 cnt = (x >> 5) - 1; | 191 cnt = (x >> 5) - 1; |
| 207 switch (state) { | 209 switch (state) { |
| 208 case COPY: | 210 case COPY: |
| 209 cnt = get_len(&c, x, 15); | 211 cnt = get_len(&c, x, 15); |
| 210 copy(&c, cnt + 3); | 212 copy(&c, cnt + 3); |
| 211 x = GETB(c); | 213 x = GETB(c); |
| 214 if (c.in > c.in_end) { | |
| 215 c.error |= LZO_INPUT_DEPLETED; | |
| 216 continue; | |
| 217 } | |
| 212 if (x >> 4) | 218 if (x >> 4) |
| 213 continue; | 219 continue; |
| 214 cnt = 1; | 220 cnt = 1; |
| 215 back = (1 << 11) + (GETB(c) << 2) + (x >> 2) + 1; | 221 back = (1 << 11) + (GETB(c) << 2) + (x >> 2) + 1; |
| 216 break; | 222 break; |