commit a9ded3d272775619760b5f0125b76d019ac3186a
author Laurent Aimar <fenrir@videolan.org> Mon Sep 19 22:48:53 2011 +0200
committer Michael Niedermayer <michaelni@gmx.at> Thu Nov 03 03:29:32 2011 +0100
tree 2cb5a3e21e3217d2726493e26c3dcd88dc1bcb35
parent ef93642aac0ddf17ecd35e3a1e463a5e7f4f9ac5

rv34: Check for invalid slice offsets

Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4cc7732386eb36661ed22d1200339b38a5fa60bc)

Signed-off-by: Anton Khirnov <anton@khirnov.net>

libavcodec/rv34.c

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 3c0e519..13415e0 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1401,8 +1401,9 @@
         slice_count = avctx->slice_count;
 
     //parse first slice header to check whether this frame can be decoded
-    if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
-        av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+    if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
+       get_slice_offset(avctx, slices_hdr, 0) > buf_size){
+        av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
         return -1;
     }
     init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0));
@@ -1430,8 +1431,8 @@
         else
             size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
 
-        if(offset > buf_size){
-            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+        if(offset < 0 || offset > buf_size || size < 0){
+            av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
             break;
         }