diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-02-10 17:54:00 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-02-10 17:54:00 +0100 |
| commit | cb85779d459c6486acbbf060b3f169779424583e (patch) | |
| tree | 092bbe1989e1b570fffc8b34c6de17549863a700 /libavcodec/dpx.c | |
| parent | 151067bbc2200e3130eb9e4bab242dfd8db78761 (diff) | |
| download | ffmpeg-cb85779d459c6486acbbf060b3f169779424583e.tar.gz | |
dpx: include offset in the total_size calculation
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/dpx.c')
| -rw-r--r-- | libavcodec/dpx.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dpx.c b/libavcodec/dpx.c index 0237b44784..310036b0cd 100644 --- a/libavcodec/dpx.c +++ b/libavcodec/dpx.c @@ -199,7 +199,7 @@ static int decode_frame(AVCodecContext *avctx, for (i=0; i<AV_NUM_DATA_POINTERS; i++) ptr[i] = p->data[i]; - if (total_size > avpkt->size) { + if (total_size + (int64_t)offset > avpkt->size) { av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n"); return AVERROR_INVALIDDATA; } |