[FFmpeg-cvslog] bmv: check for len being valid in bmv_decode_frame().
Anton Khirnov
git at videolan.org
Mon Jul 29 02:44:26 CEST 2013
ffmpeg | branch: release/0.10 | Anton Khirnov <anton at khirnov.net> | Thu Mar 28 10:09:36 2013 +0100| [0f6364b62bb5f10b25d8cef88acbb9df84fd7f48] | committer: Reinhard Tartler
bmv: check for len being valid in bmv_decode_frame().
It can be 0 or -1 for invalid files, which may result in invalid memory
access.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
(cherry picked from commit b88f902125ee808c8366e9dcb3f21e4c227483fc)
Conflicts:
libavcodec/bmv.c
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0f6364b62bb5f10b25d8cef88acbb9df84fd7f48
---
libavcodec/bmv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libavcodec/bmv.c b/libavcodec/bmv.c
index 49346a4..920e752 100644
--- a/libavcodec/bmv.c
+++ b/libavcodec/bmv.c
@@ -134,7 +134,7 @@ static int decode_bmv_frame(const uint8_t *source, int src_len, uint8_t *frame,
mode += 1 + advance_mode;
if (mode >= 4)
mode -= 3;
- if (FFABS(dst_end - dst) < len)
+ if (len <= 0 || FFABS(dst_end - dst) < len)
return -1;
switch (mode) {
case 1:
More information about the ffmpeg-cvslog
mailing list