changeset 9490:9999ab77829b libavcodec

Fix buffer size check for xan_unpack which was broken by r18586
author reimar
date Fri, 17 Apr 2009 19:07:16 +0000
parents f4fdab353f6f
children 28978a75c865
files xan.c
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/xan.c	Fri Apr 17 19:03:43 2009 +0000
+++ b/xan.c	Fri Apr 17 19:07:16 2009 +0000
@@ -156,7 +156,7 @@
 
                 back = ((opcode & 0x10) << 12) + 1 + bytestream_get_be16(&src);
                 size2 = *src++ + 5 + ((opcode & 0xc) << 6);
-                if (dest >= dest_end || size > dest_end - dest)
+                if (size + size2 > dest_end - dest)
                     return;
             }
             memcpy(dest, src, size);  dest += size;  src += size;