[SCM] libav/experimental: fix segfault (bug #1165640)
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Jun 30 15:44:37 UTC 2013
The following commit has been merged in the experimental branch:
commit 1a55810e878efefe3b8c128d57af3a66949872e0
Author: Michael Niedermayer <michaelni at gmx.at>
Date: Mon Jul 11 22:56:23 2005 +0000
fix segfault (bug #1165640)
Originally committed as revision 4435 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/libavcodec/8bps.c b/libavcodec/8bps.c
index 3898ac5..4d5a64e 100644
--- a/libavcodec/8bps.c
+++ b/libavcodec/8bps.c
@@ -100,11 +100,13 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, uint8
dlen = be2me_16(*(unsigned short *)(lp+row*2));
/* Decode a row of this plane */
while(dlen > 0) {
+ if(dp + 1 >= buf+buf_size) return -1;
if ((count = *dp++) <= 127) {
count++;
dlen -= count + 1;
if (pixptr + count * px_inc > pixptr_end)
break;
+ if(dp + count > buf+buf_size) return -1;
while(count--) {
*pixptr = *dp++;
pixptr += px_inc;
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list