Mercurial > libavcodec.hg

changeset 4419:4ade01ded107 libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fix buffer end checks in lzo copy code to work in all cases.
author reimar
date Sat, 27 Jan 2007 14:15:03 +0000
parents 4cceb7c877af
children 1e86a8f18693
files lzo.c
diffstat 1 files changed, 4 insertions(+), 4 deletions(-) [+]
line wrap: on
line diff
--- a/lzo.c	Sat Jan 27 14:10:57 2007 +0000
+++ b/lzo.c	Sat Jan 27 14:15:03 2007 +0000
@@ -67,11 +67,11 @@
 static inline void copy(LZOContext *c, int cnt) {
     register uint8_t *src = c->in;
     register uint8_t *dst = c->out;
-    if (src + cnt > c->in_end) {
+    if (src + cnt > c->in_end || src + cnt < src) {
         cnt = c->in_end - src;
         c->error |= LZO_INPUT_DEPLETED;
     }
-    if (dst + cnt > c->out_end) {
+    if (dst + cnt > c->out_end || dst + cnt < dst) {
         cnt = c->out_end - dst;
         c->error |= LZO_OUTPUT_FULL;
     }
@@ -101,11 +101,11 @@
 static inline void copy_backptr(LZOContext *c, int back, int cnt) {
     register uint8_t *src = &c->out[-back];
     register uint8_t *dst = c->out;
-    if (src < c->out_start) {
+    if (src < c->out_start || src > dst) {
         c->error |= LZO_INVALID_BACKPTR;
         return;
     }
-    if (dst + cnt > c->out_end) {
+    if (dst + cnt > c->out_end || dst +  cnt < dst) {
         cnt = c->out_end - dst;
         c->error |= LZO_OUTPUT_FULL;
     }