Mercurial > libavcodec.hg

changeset 9758:8ebcc162db3d libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Add sanity check for mthread_inlen, avoids crashes due to invalid reads.
author reimar
date Sun, 31 May 2009 09:59:46 +0000
parents 8e4d442554b3
children 5968a9f15535
files lcldec.c
diffstat 1 files changed, 2 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/lcldec.c	Sun May 31 09:57:42 2009 +0000
+++ b/lcldec.c	Sun May 31 09:59:46 2009 +0000
@@ -190,6 +190,7 @@
         case COMP_MSZH:
             if (c->flags & FLAG_MULTITHREAD) {
                 mthread_inlen = *(unsigned int*)encoded;
+                mthread_inlen = FFMIN(mthread_inlen, len - 8);
                 mthread_outlen = *(unsigned int*)(encoded+4);
                 mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
                 mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size);
@@ -236,6 +237,7 @@
         if (c->flags & FLAG_MULTITHREAD) {
             int ret;
             mthread_inlen = *(unsigned int*)encoded;
+            mthread_inlen = FFMIN(mthread_inlen, len - 8);
             mthread_outlen = *(unsigned int*)(encoded+4);
             mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
             ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen);