Mercurial > libavcodec.hg
comparison smacker.c @ 5676:71dc0d839b28 libavcodec
Check unp_size for possible overflows too
| author | kostya |
|---|---|
| date | Fri, 14 Sep 2007 06:01:29 +0000 |
| parents | ca944f1db2b3 |
| children | 743c1ef20291 |
comparison
equal
deleted
inserted
replaced
| 5675:d328f1731a6c | 5676:71dc0d839b28 |
|---|---|
| 588 *data_size = 0; | 588 *data_size = 0; |
| 589 return 1; | 589 return 1; |
| 590 } | 590 } |
| 591 stereo = get_bits1(&gb); | 591 stereo = get_bits1(&gb); |
| 592 bits = get_bits1(&gb); | 592 bits = get_bits1(&gb); |
| 593 if ((unp_size << !bits) > *data_size) { | 593 if (unp_size & 0xC0000000 || (unp_size << !bits) > *data_size) { |
| 594 av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); | 594 av_log(avctx, AV_LOG_ERROR, "Frame is too large to fit in buffer\n"); |
| 595 return -1; | 595 return -1; |
| 596 } | 596 } |
| 597 | 597 |
| 598 memset(vlc, 0, sizeof(VLC) * 4); | 598 memset(vlc, 0, sizeof(VLC) * 4); |