Commit ddcf67c8 authored by Ronald S. Bultje's avatar Ronald S. Bultje

lzw: prevent buffer overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
parent 28e8c4d5
...@@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p) ...@@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p)
struct LZWState *s = (struct LZWState *)p; struct LZWState *s = (struct LZWState *)p;
if(s->mode == FF_LZW_GIF) { if(s->mode == FF_LZW_GIF) {
while(s->pbuf < s->ebuf && s->bs>0){ while (s->bs > 0) {
s->pbuf += s->bs; if (s->pbuf + s->bs >= s->ebuf) {
s->bs = *s->pbuf++; s->pbuf = s->ebuf;
break;
} else {
s->pbuf += s->bs;
s->bs = *s->pbuf++;
}
} }
}else }else
s->pbuf= s->ebuf; s->pbuf= s->ebuf;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment