Commit cb85779d authored by Michael Niedermayer's avatar Michael Niedermayer

dpx: include offset in the total_size calculation

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 151067bb
......@@ -199,7 +199,7 @@ static int decode_frame(AVCodecContext *avctx,
for (i=0; i<AV_NUM_DATA_POINTERS; i++)
ptr[i] = p->data[i];
if (total_size > avpkt->size) {
if (total_size + (int64_t)offset > avpkt->size) {
av_log(avctx, AV_LOG_ERROR, "Overread buffer. Invalid header?\n");
return AVERROR_INVALIDDATA;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment