Skip to content

F
ffmpeg.wasm-core
Commit 6d45702f authored by Laurent Aimar's avatar Laurent Aimar Committed by Michael Niedermayer
Browse files
Options

vqavideo: check for out of bound reads. 

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent e3123856
Hide whitespace changes
Inline Side-by-side
Showing with 6 additions and 0 deletions
libavcodec/vqavideo.c
View file @ 6d45702f
...@@ -230,6 +230,8 @@ static void decode_format80(const unsigned char *src, int src_size, ...@@ -230,6 +230,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2; src_index += 2;
av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos); av_dlog(NULL, "(1) copy %X bytes from absolute pos %X\n", count, src_pos);
CHECK_COUNT(); CHECK_COUNT();
if (src_pos + count > dest_size)
return;
for (i = 0; i < count; i++) for (i = 0; i < count; i++)
dest[dest_index + i] = dest[src_pos + i]; dest[dest_index + i] = dest[src_pos + i];
dest_index += count; dest_index += count;
...@@ -252,6 +254,8 @@ static void decode_format80(const unsigned char *src, int src_size, ...@@ -252,6 +254,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2; src_index += 2;
av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos); av_dlog(NULL, "(3) copy %X bytes from absolute pos %X\n", count, src_pos);
CHECK_COUNT(); CHECK_COUNT();
if (src_pos + count > dest_size)
return;
for (i = 0; i < count; i++) for (i = 0; i < count; i++)
dest[dest_index + i] = dest[src_pos + i]; dest[dest_index + i] = dest[src_pos + i];
dest_index += count; dest_index += count;
...@@ -272,6 +276,8 @@ static void decode_format80(const unsigned char *src, int src_size, ...@@ -272,6 +276,8 @@ static void decode_format80(const unsigned char *src, int src_size,
src_index += 2; src_index += 2;
av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos); av_dlog(NULL, "(5) copy %X bytes from relpos %X\n", count, src_pos);
CHECK_COUNT(); CHECK_COUNT();
if (dest_index < src_pos)
return;
for (i = 0; i < count; i++) for (i = 0; i < count; i++)
dest[dest_index + i] = dest[dest_index - src_pos + i]; dest[dest_index + i] = dest[dest_index - src_pos + i];
dest_index += count; dest_index += count;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment