Chiebot-Mirror
/
FFmpeg
mirror of https://github.com/FFmpeg/FFmpeg.git
8
0
Fork 0
Code Issues Projects Releases Wiki Activity

eacmv: fix potential pointer arithmetic overflows

Browse Source 
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
pull/2/head
Laurent Aimar 13 years ago committed by Janne Grunau
parent c7f89064e2
commit 8df8a87e3f
1 changed files with 4 additions and 4 deletions
Whitespace
Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL
Unified View
Diff Options
Show Stats Download Patch File Download Diff File
  1. 8
      libavcodec/eacmv.c

8
libavcodec/eacmv.c
Unescape View File

@ -52,7 +52,7 @@ static void cmv_decode_intra(CmvContext * s, const uint8_t *buf, const uint8_t *
unsigned char *dst = s->frame.data[0]; unsigned char *dst = s->frame.data[0];
int i; int i;
for (i=0; i < s->avctx->height && buf+s->avctx->width<=buf_end; i++) { for (i=0; i < s->avctx->height && buf_end - buf >= s->avctx->width; i++) {
memcpy(dst, buf, s->avctx->width); memcpy(dst, buf, s->avctx->width);
dst += s->frame.linesize[0]; dst += s->frame.linesize[0];
buf += s->avctx->width; buf += s->avctx->width;
@ -84,7 +84,7 @@ static void cmv_decode_inter(CmvContext * s, const uint8_t *buf, const uint8_t *
i = 0; i = 0;
for(y=0; y<s->avctx->height/4; y++) for(y=0; y<s->avctx->height/4; y++)
for(x=0; x<s->avctx->width/4 && buf+i<buf_end; x++) { for(x=0; x<s->avctx->width/4 && buf_end - buf > i; x++) {
if (buf[i]==0xFF) { if (buf[i]==0xFF) {
unsigned char *dst = s->frame.data[0] + (y*4)*s->frame.linesize[0] + x*4; unsigned char *dst = s->frame.data[0] + (y*4)*s->frame.linesize[0] + x*4;
if (raw+16<buf_end && *raw==0xFF) { /* intra */ if (raw+16<buf_end && *raw==0xFF) { /* intra */
@ -118,7 +118,7 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t
{ {
int pal_start, pal_count, i; int pal_start, pal_count, i;
if(buf+16>=buf_end) { if(buf_end - buf < 16) {
av_log(s->avctx, AV_LOG_WARNING, "truncated header\n"); av_log(s->avctx, AV_LOG_WARNING, "truncated header\n");
return; return;
} }
@ -135,7 +135,7 @@ static void cmv_process_header(CmvContext *s, const uint8_t *buf, const uint8_t
pal_count = AV_RL16(&buf[14]); pal_count = AV_RL16(&buf[14]);
buf += 16; buf += 16;
for (i=pal_start; i<pal_start+pal_count && i<AVPALETTE_COUNT && buf+2<buf_end; i++) { for (i=pal_start; i<pal_start+pal_count && i<AVPALETTE_COUNT && buf_end - buf >= 3; i++) {
s->palette[i] = AV_RB24(buf); s->palette[i] = AV_RB24(buf);
buf += 3; buf += 3;
} }

Write Preview
Loading…
Cancel
Save