Commit 5fe9c42c authored by Reimar Döffinger's avatar Reimar Döffinger

Add two extra needed bounds checks

Originally committed as revision 7777 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 801778bc
...@@ -182,6 +182,8 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) { ...@@ -182,6 +182,8 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) {
x = GETB(c); x = GETB(c);
if (x < 16) c.error |= LZO_ERROR; if (x < 16) c.error |= LZO_ERROR;
} }
if (c.in > c.in_end)
c.error |= LZO_INPUT_DEPLETED;
while (!c.error) { while (!c.error) {
int cnt, back; int cnt, back;
if (x > 15) { if (x > 15) {
...@@ -209,6 +211,10 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) { ...@@ -209,6 +211,10 @@ int lzo1x_decode(void *out, int *outlen, void *in, int *inlen) {
cnt = get_len(&c, x, 15); cnt = get_len(&c, x, 15);
copy(&c, cnt + 3); copy(&c, cnt + 3);
x = GETB(c); x = GETB(c);
if (c.in > c.in_end) {
c.error |= LZO_INPUT_DEPLETED;
continue;
}
if (x >> 4) if (x >> 4)
continue; continue;
cnt = 1; cnt = 1;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment