[FFmpeg-cvslog] avutil/lzo: Fix integer overflow
Michael Niedermayer
git at videolan.org
Mon Jun 23 15:49:25 CEST 2014
ffmpeg | branch: release/2.2 | Michael Niedermayer <michaelni at gmx.at> | Fri Jun 20 03:15:28 2014 +0200| [7d9c059a3525aa9f3e257b4c13df2b8c30409f3c] | committer: Michael Niedermayer
avutil/lzo: Fix integer overflow
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)
Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb at securitymouse.com>
See: ccda51b14c0fcae2fad73a24872dce75a7964996
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit d6af26c55c1ea30f85a7d9edbc373f53be1743ee)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7d9c059a3525aa9f3e257b4c13df2b8c30409f3c
---
libavutil/lzo.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index 221a66b..82dba94 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -65,8 +65,13 @@ static inline int get_len(LZOContext *c, int x, int mask)
{
int cnt = x & mask;
if (!cnt) {
- while (!(x = get_byte(c)))
+ while (!(x = get_byte(c))) {
+ if (cnt >= INT_MAX - 1000) {
+ c->error |= AV_LZO_ERROR;
+ break;
+ }
cnt += 255;
+ }
cnt += mask + x;
}
return cnt;
More information about the ffmpeg-cvslog
mailing list