You've already forked FFmpeg
mirror of
https://github.com/FFmpeg/FFmpeg.git
synced 2025-08-15 14:13:16 +02:00
avcodec/iff: decode_delta_j: Check that the number of bytes that will be read are available
This should avoid long loops related to CID1361958 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
@@ -865,7 +865,7 @@ static void decode_delta_j(uint8_t *dst,
|
|||||||
for (g = 0; g < groups; g++) {
|
for (g = 0; g < groups; g++) {
|
||||||
offset = bytestream2_get_be16(&gb);
|
offset = bytestream2_get_be16(&gb);
|
||||||
|
|
||||||
if (bytestream2_get_bytes_left(&gb) < 1)
|
if (cols * bpp == 0 || bytestream2_get_bytes_left(&gb) < cols * bpp)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
if (kludge_j)
|
if (kludge_j)
|
||||||
@@ -911,7 +911,7 @@ static void decode_delta_j(uint8_t *dst,
|
|||||||
for (d = 0; d < bpp; d++) {
|
for (d = 0; d < bpp; d++) {
|
||||||
unsigned noffset = offset + (r * pitch) + d * planepitch;
|
unsigned noffset = offset + (r * pitch) + d * planepitch;
|
||||||
|
|
||||||
if (bytestream2_get_bytes_left(&gb) < 1)
|
if (!bytes || bytestream2_get_bytes_left(&gb) < bytes)
|
||||||
return;
|
return;
|
||||||
|
|
||||||
for (b = 0; b < bytes; b++) {
|
for (b = 0; b < bytes; b++) {
|
||||||
|
Reference in New Issue
Block a user