Mercurial > libavcodec.hg

changeset 5697:a3fec73667af libavcodec

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Guard against output buffer overflows
author kostya
date Sat, 22 Sep 2007 09:21:43 +0000
parents 914ff70e1367
children 9a26cb6747a9
files dpcm.c
diffstat 1 files changed, 6 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/dpcm.c	Sat Sep 22 09:09:47 2007 +0000
+++ b/dpcm.c	Sat Sep 22 09:21:43 2007 +0000
@@ -173,6 +173,10 @@
     if (!buf_size)
         return 0;
 
+    // almost every DPCM variant expands one byte of data into two
+    if(*data_size/2 < buf_size)
+        return -1;
+
     switch(avctx->codec->id) {
 
     case CODEC_ID_ROQ_DPCM:
@@ -256,6 +260,8 @@
     case CODEC_ID_SOL_DPCM:
         in = 0;
         if (avctx->codec_tag != 3) {
+            if(*data_size/4 < buf_size)
+                return -1;
             while (in < buf_size) {
                 int n1, n2;
                 n1 = (buf[in] >> 4) & 0xF;