mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2024-12-23 12:43:46 +02:00
check that csize in ff_lzw_decode_init is < LZW_MAXBITS, <= is not enough and
might read outside the prefix array Originally committed as revision 14214 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
parent
4138ad961c
commit
b08edb2268
@ -131,7 +131,7 @@ int ff_lzw_decode_init(LZWState *p, int csize, const uint8_t *buf, int buf_size,
|
||||
{
|
||||
struct LZWState *s = (struct LZWState *)p;
|
||||
|
||||
if(csize < 1 || csize > LZW_MAXBITS)
|
||||
if(csize < 1 || csize >= LZW_MAXBITS)
|
||||
return -1;
|
||||
/* read buffer */
|
||||
s->pbuf = buf;
|
||||
|
Loading…
Reference in New Issue
Block a user