Mercurial > libavcodec.hg
comparison lcldec.c @ 9763:d359d5ee74b9 libavcodec
Change buffer size checks to avoid the undefined overflow case.
| author | reimar |
|---|---|
| date | Sun, 31 May 2009 10:23:38 +0000 |
| parents | 3242ae563430 |
| children | dd6bcbec3c24 |
comparison
equal
deleted
inserted
replaced
| 9762:3242ae563430 | 9763:d359d5ee74b9 |
|---|---|
| 85 maskbit = 8; | 85 maskbit = 8; |
| 86 srclen--; | 86 srclen--; |
| 87 continue; | 87 continue; |
| 88 } | 88 } |
| 89 if ((mask & (1 << (--maskbit))) == 0) { | 89 if ((mask & (1 << (--maskbit))) == 0) { |
| 90 if (destptr + 4 > destptr_end) | 90 if (destptr_end - destptr < 4) |
| 91 break; | 91 break; |
| 92 memcpy(destptr, srcptr, 4); | 92 memcpy(destptr, srcptr, 4); |
| 93 srclen -= 4; | 93 srclen -= 4; |
| 94 destptr += 4; | 94 destptr += 4; |
| 95 srcptr += 4; | 95 srcptr += 4; |
| 99 ofs += cnt * 256; | 99 ofs += cnt * 256; |
| 100 cnt = ((cnt >> 3) & 0x1f) + 1; | 100 cnt = ((cnt >> 3) & 0x1f) + 1; |
| 101 ofs &= 0x7ff; | 101 ofs &= 0x7ff; |
| 102 srclen -= 2; | 102 srclen -= 2; |
| 103 cnt *= 4; | 103 cnt *= 4; |
| 104 if (destptr + cnt > destptr_end) { | 104 if (destptr_end - destptr < cnt) { |
| 105 cnt = destptr_end - destptr; | 105 cnt = destptr_end - destptr; |
| 106 } | 106 } |
| 107 for (; cnt > 0; cnt--) { | 107 for (; cnt > 0; cnt--) { |
| 108 *destptr = *(destptr - ofs); | 108 *destptr = *(destptr - ofs); |
| 109 destptr++; | 109 destptr++; |