Skip to content
Permalink
Browse files Browse the repository at this point in the history
avcodec/utvideodec: Fix bytes left check in decode_frame()
Fixes: out of array read
Fixes: poc-2017.avi

Found-by: GwanYeong Kim <gy741.kim@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 118e1b0)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Jul 8, 2018
1 parent 7cc7346 commit 22aa37c
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion libavcodec/utvideodec.c
Expand Up @@ -534,7 +534,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
for (j = 0; j < c->slices; j++) {
slice_end = bytestream2_get_le32u(&gb);
if (slice_end < 0 || slice_end < slice_start ||
bytestream2_get_bytes_left(&gb) < slice_end) {
bytestream2_get_bytes_left(&gb) < slice_end + 1024LL) {
av_log(avctx, AV_LOG_ERROR, "Incorrect slice size\n");
return AVERROR_INVALIDDATA;
}
Expand Down

0 comments on commit 22aa37c

Please sign in to comment.