ffmpeg/FFmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-09-20 05:16:38 +00:00
Code Issues Packages Projects Releases Wiki Activity

truemotion1: check the header size

Browse Source 
Fixes invalid reads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-11-28 10:54:35 +01:00
parent 1713eec29a
commit 2240e2078d
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/truemotion1.c
View File

@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
return AVERROR_INVALIDDATA;
}
if (header.header_size + 1 > s->size) {
av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
return AVERROR_INVALIDDATA;
}
/* unscramble the header bytes with a XOR operation */
for (i = 1; i < header.header_size; i++)
header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];