Commit ca6c3f2c authored by Xi Wang's avatar Xi Wang Committed by Luca Barbato

lzo: fix overflow checking in copy_backptr()

The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.

Remove the check.  Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.

CC: libav-stable@libav.org
Signed-off-by: 's avatarXi Wang <xi.wang@gmail.com>
Signed-off-by: 's avatarLuca Barbato <lu_zero@gentoo.org>
parent 8425d693
...@@ -110,9 +110,8 @@ static inline void copy(LZOContext *c, int cnt) ...@@ -110,9 +110,8 @@ static inline void copy(LZOContext *c, int cnt)
*/ */
static inline void copy_backptr(LZOContext *c, int back, int cnt) static inline void copy_backptr(LZOContext *c, int back, int cnt)
{ {
register const uint8_t *src = &c->out[-back];
register uint8_t *dst = c->out; register uint8_t *dst = c->out;
if (src < c->out_start || src > dst) { if (dst - c->out_start < back) {
c->error |= AV_LZO_INVALID_BACKPTR; c->error |= AV_LZO_INVALID_BACKPTR;
return; return;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment