"Ronald S. Bultje" <[email protected]> writes:
> From: "Ronald S. Bultje" <[email protected]>
>
> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
> CC: [email protected]
> ---
> libavcodec/lzw.c | 11 ++++++++---
> 1 file changed, 8 insertions(+), 3 deletions(-)
>
> diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c
> index 873b314..b674d4e 100644
> --- a/libavcodec/lzw.c
> +++ b/libavcodec/lzw.c
> @@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p)
> struct LZWState *s = (struct LZWState *)p;
>
> if(s->mode == FF_LZW_GIF) {
> - while(s->pbuf < s->ebuf && s->bs>0){
> - s->pbuf += s->bs;
> - s->bs = *s->pbuf++;
> + while (s->bs > 0) {
> + if (s->pbuf + s->bs >= s->ebuf) {
This addition can overflow. The correct test is s->bs >= s->ebuf - s->pbuf.
> + s->pbuf = s->ebuf;
> + break;
> + } else {
> + s->pbuf += s->bs;
> + s->bs = *s->pbuf++;
> + }
> }
> }else
> s->pbuf= s->ebuf;
> --
> 1.7.9.2
>
--
Måns Rullgård
[email protected]
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
