Module: libav Branch: release/0.8 Commit: cab96248927a171821dcee1434d73489d1ef9723
Author: Xi Wang <xi.w...@gmail.com> Committer: Luca Barbato <lu_z...@gentoo.org> Date: Fri Mar 15 06:59:22 2013 -0400 lzo: fix overflow checking in copy_backptr() The check `src > dst' in the form `&c->out[-back] > c->out' invokes pointer overflow, which is undefined behavior in C. Remove the check. Also replace `&c->out[-back] < c->out_start' with a safe form `c->out - c->out_start < back' to avoid overflow. CC: libav-sta...@libav.org Signed-off-by: Xi Wang <xi.w...@gmail.com> Signed-off-by: Luca Barbato <lu_z...@gentoo.org> (cherry picked from commit ca6c3f2c53be70aa3c38e8f1292809db89ea1ba6) Conflicts: libavutil/lzo.c --- libavutil/lzo.c | 3 +-- 1 files changed, 1 insertions(+), 2 deletions(-) diff --git a/libavutil/lzo.c b/libavutil/lzo.c index 26cda12..e49b83e 100644 --- a/libavutil/lzo.c +++ b/libavutil/lzo.c @@ -119,9 +119,8 @@ static inline void memcpy_backptr(uint8_t *dst, int back, int cnt); * thus creating a repeating pattern with a period length of back. */ static inline void copy_backptr(LZOContext *c, int back, int cnt) { - register const uint8_t *src = &c->out[-back]; register uint8_t *dst = c->out; - if (src < c->out_start || src > dst) { + if (dst - c->out_start < back) { c->error |= AV_LZO_INVALID_BACKPTR; return; } _______________________________________________ libav-commits mailing list libav-commits@libav.org https://lists.libav.org/mailman/listinfo/libav-commits