From ffe31c654d0e7218ca36fb7884bac35736e232bb Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Fri, 22 Nov 2013 23:48:58 +0100 Subject: [PATCH] avcodec/hnm4video: check writeoffset in decode_interframe_v4a() Signed-off-by: Michael Niedermayer --- libavcodec/hnm4video.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index f394032288..742b1d3346 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -287,6 +287,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src, if (tag == 0) { writeoffset += bytestream2_get_byte(&gb); } else if (tag == 1) { + if (writeoffset + hnm->width >= hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } hnm->current[writeoffset] = bytestream2_get_byte(&gb); hnm->current[writeoffset + hnm->width] = bytestream2_get_byte(&gb); writeoffset++; @@ -295,6 +299,10 @@ static void decode_interframe_v4a(AVCodecContext *avctx, uint8_t *src, } else if (tag == 3) { break; } + if (writeoffset > hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } } else { delta = bytestream2_peek_byte(&gb) & 0x80; previous = bytestream2_peek_byte(&gb) & 0x40;