Skip to content

F
ffmpeg.wasm-core
Commit 4b96f43f authored by Reimar Döffinger's avatar Reimar Döffinger
Browse files
Options

Change buffer size checks to avoid the very unlikely overflow case. 

Originally committed as revision 18576 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 38a7695f
Hide whitespace changes
Inline Side-by-side
Showing with 7 additions and 7 deletions
libavcodec/xan.c
View file @ 4b96f43f
...@@ -140,12 +140,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l ...@@ -140,12 +140,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
offset = *src++; offset = *src++;
size = opcode & 3; size = opcode & 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = ((opcode & 0x1c) >> 2) + 3; size = ((opcode & 0x1c) >> 2) + 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size); av_memcpy_backptr(dest, ((opcode & 0x60) << 3) + offset + 1, size);
dest += size; dest += size;
...@@ -156,12 +156,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l ...@@ -156,12 +156,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
byte2 = *src++; byte2 = *src++;
size = byte1 >> 6; size = byte1 >> 6;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = (opcode & 0x3f) + 4; size = (opcode & 0x3f) + 4;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size); av_memcpy_backptr(dest, ((byte1 & 0x3f) << 8) + byte2 + 1, size);
dest += size; dest += size;
...@@ -173,12 +173,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l ...@@ -173,12 +173,12 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
byte3 = *src++; byte3 = *src++;
size = opcode & 3; size = opcode & 3;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
size = byte3 + 5 + ((opcode & 0xc) << 6); size = byte3 + 5 + ((opcode & 0xc) << 6);
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
av_memcpy_backptr(dest, av_memcpy_backptr(dest,
((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2, ((opcode & 0x10) << 12) + 1 + (byte1 << 8) + byte2,
...@@ -190,7 +190,7 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l ...@@ -190,7 +190,7 @@ static void xan_unpack(unsigned char *dest, const unsigned char *src, int dest_l
if (size > 0x70) if (size > 0x70)
break; break;
if (dest + size > dest_end) if (size > dest_end - dest)
return; return;
memcpy(dest, src, size); dest += size; src += size; memcpy(dest, src, size); dest += size; src += size;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment