You've already forked FFmpeg
mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-08-10 06:10:52 +02:00
dsicinav: Bound-check the source buffer when needed
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org
This commit is contained in:
@@ -195,11 +195,13 @@ static void cin_decode_rle(const unsigned char *src, int src_size,
|
||||
while (src < src_end && dst < dst_end) {
|
||||
code = *src++;
|
||||
if (code & 0x80) {
|
||||
if (src >= src_end)
|
||||
break;
|
||||
len = code - 0x7F;
|
||||
memset(dst, *src++, FFMIN(len, dst_end - dst));
|
||||
} else {
|
||||
len = code + 1;
|
||||
memcpy(dst, src, FFMIN(len, dst_end - dst));
|
||||
memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src));
|
||||
src += len;
|
||||
}
|
||||
dst += len;
|
||||
|
Reference in New Issue
Block a user