[FFmpeg-cvslog] lzo: fix overflow checking in copy_backptr()

[Xi Wang]

ffmpeg | branch: release/0.7 | Xi Wang <xi.wang at gmail.com> | Fri Mar 15 06:59:22 2013 -0400| [530d10792de29a25dc56781abe6864e5b31b8ced] | committer: Reinhard Tartler

lzo: fix overflow checking in copy_backptr()

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable at libav.org

Signed-off-by: Xi Wang <xi.wang at gmail.com>
Signed-off-by: Luca Barbato <lu_zero at gentoo.org>

(cherry picked from commit ca6c3f2c53be70aa3c38e8f1292809db89ea1ba6)

Conflicts:
	libavutil/lzo.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=530d10792de29a25dc56781abe6864e5b31b8ced
---

 libavutil/lzo.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index ef01653..9cc82dc 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -119,9 +119,8 @@ static inline void memcpy_backptr(uint8_t *dst, int back, int cnt);
  * thus creating a repeating pattern with a period length of back.
  */
 static inline void copy_backptr(LZOContext *c, int back, int cnt) {
-    register const uint8_t *src = &c->out[-back];
     register uint8_t *dst = c->out;
-    if (src < c->out_start || src > dst) {
+    if (dst - c->out_start < back) {
         c->error |= AV_LZO_INVALID_BACKPTR;
         return;
     }