mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
truemotion1: check the header size
Fixes invalid reads. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC:libav-stable@libav.org
This commit is contained in:
parent
1713eec29a
commit
2240e2078d
@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
if (header.header_size + 1 > s->size) {
|
||||
av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
|
||||
return AVERROR_INVALIDDATA;
|
||||
}
|
||||
|
||||
/* unscramble the header bytes with a XOR operation */
|
||||
for (i = 1; i < header.header_size; i++)
|
||||
header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];
|
||||
|
Loading…
Reference in New Issue
Block a user