Skip to content

Commit 22aa37c

Browse files
committed
avcodec/utvideodec: Fix bytes left check in decode_frame()
Fixes: out of array read Fixes: poc-2017.avi Found-by: GwanYeong Kim <gy741.kim@gmail.com> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 118e1b0) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
1 parent 7cc7346 commit 22aa37c

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

Diff for: libavcodec/utvideodec.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -534,7 +534,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
534534
for (j = 0; j < c->slices; j++) {
535535
slice_end = bytestream2_get_le32u(&gb);
536536
if (slice_end < 0 || slice_end < slice_start ||
537-
bytestream2_get_bytes_left(&gb) < slice_end) {
537+
bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {
538538
av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
539539
return AVERROR_INVALIDDATA;
540540
}

0 commit comments

Comments
 (0)