Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

Change buffer size checks to avoid the very unlikely overflow case.

Browse Source 
Originally committed as revision 18576 to svn://svn.ffmpeg.org/ffmpeg/trunk
release/0.6
Reimar Döffinger 16 years ago
parent 38a7695f67
commit 4b96f43fe1
1 changed files with 7 additions and 7 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 14
      libavcodec/xan.c

14
libavcodec/xan.c
Unescape View File

@ -140,12 +140,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
offset = *src++; offset = *src++;
size = opcode & 3; size = opcode & 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = ((opcode & 0x1c) >> 2) + 3; size = ((opcode & 0x1c) >> 2) + 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size); av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size);
dest += size; dest += size;
@ -156,12 +156,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
byte2 = *src++; byte2 = *src++;
size = byte1 >> 6; size = byte1 >> 6;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = (opcode & 0x3f) + 4; size = (opcode & 0x3f) + 4;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size); av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size);
dest += size; dest += size;
@ -173,12 +173,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
byte3 = *src++; byte3 = *src++;
size = opcode & 3; size = opcode & 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = byte3 + 5 + ((opcode & 0xc) << 6); size = byte3 + 5 + ((opcode & 0xc) << 6);
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, av_memcpy_backptr(dest,
((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2, ((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2,
@ -190,7 +190,7 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
if (size > 0x70) if (size > 0x70)
break; break;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
} }

Write Preview
Loading…
Cancel
Save