Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:[email protected]
---
libavcodec/truemotion1.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/truemotion1.c b/libavcodec/truemotion1.c
index b1497d5..270a030 100644
--- a/libavcodec/truemotion1.c
+++ b/libavcodec/truemotion1.c
@@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s)
return AVERROR_INVALIDDATA;
}
+ if (header.header_size + 1 > s->size) {
+ av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
+ return AVERROR_INVALIDDATA;
+ }
+
/* unscramble the header bytes with a XOR operation */
for (i = 1; i < header.header_size; i++)
header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];
--
1.7.10.4
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
