truemotion1: check the header size

Fixes invalid reads.

Anton Khirnov committed 12 years ago

Commit 2240e201 parent 1713eec1 file · +5 −0Browse files

Unified · Split

libavcodec/truemotion1.c+5−0

@@ -323,6 +323,11 @@ static int truemotion1_decode_header(TrueMotion1Context *s) · 322 unmodified lines
323	323	return AVERROR_INVALIDDATA;
324	324	}
325	325
	326	+ if (header.header_size + 1 > s->size) {
	327	+ av_log(s->avctx, AV_LOG_ERROR, "Input packet too small.\n");
	328	+ return AVERROR_INVALIDDATA;
	329	+ }
	330	+
326	331	/* unscramble the header bytes with a XOR operation */
327	332	for (i = 1; i < header.header_size; i++)
328	333	header_buffer[i - 1] = s->buf[i] ^ s->buf[i + 1];