Mercurial > libavcodec.hg
changeset 9479:6e649626d0c1 libavcodec
Change buffer size checks to avoid the very unlikely overflow case.
| author | reimar |
|---|---|
| date | Fri, 17 Apr 2009 18:03:00 +0000 |
| parents | b0874961f1e2 |
| children | d527872fdf26 |
| files | xan.c |
| diffstat | 1 files changed, 7 insertions(+), 7 deletions(-) [+] |
line wrap: on
line diff
--- a/xan.c Fri Apr 17 17:56:16 2009 +0000 +++ b/xan.c Fri Apr 17 18:03:00 2009 +0000 @@ -140,12 +140,12 @@ offset = *src++; size = opcode & 3; - if (dest + size > dest_end) + if (size > dest_end - dest) return; memcpy(dest, src, size); dest += size; src += size; size = ((opcode & 0x1c) >> 2) + 3; - if (dest + size > dest_end) + if (size > dest_end - dest) return; av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size); dest += size; @@ -156,12 +156,12 @@ byte2 = *src++; size = byte1 >> 6; - if (dest + size > dest_end) + if (size > dest_end - dest) return; memcpy(dest, src, size); dest += size; src += size; size = (opcode & 0x3f) + 4; - if (dest + size > dest_end) + if (size > dest_end - dest) return; av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size); dest += size; @@ -173,12 +173,12 @@ byte3 = *src++; size = opcode & 3; - if (dest + size > dest_end) + if (size > dest_end - dest) return; memcpy(dest, src, size); dest += size; src += size; size = byte3 + 5 + ((opcode & 0xc) << 6); - if (dest + size > dest_end) + if (size > dest_end - dest) return; av_memcpy_backptr(dest, ((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2, @@ -190,7 +190,7 @@ if (size > 0x70) break; - if (dest + size > dest_end) + if (size > dest_end - dest) return; memcpy(dest, src, size); dest += size; src += size; }