Check for out of bound reads in xan_huffman_decode() of the xan decoder.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
14 years ago · c8b835954a
parent 7afe23808a
commit c8b835954a
1 changed files with 4 additions and 1 deletions
--- a/libavcodec/xan.c
+++ b/libavcodec/xan.c
@ -114,7 +114,10 @@ static int xan_huffman_decode(unsigned char *dest, int dest_len,
    init_get_bits(&gb, ptr, ptr_len * 8);

    while ( val != 0x16 ) {
-        val = src[val - 0x17 + get_bits1(&gb) * byte];
+        unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
+        if (idx >= 2 * byte)
+            return -1;
+        val = src[idx];

        if ( val < 0x16 ) {
            if (dest >= dest_end)