Fixes: writing over the end of the array Fixes: BIGSLEEP-434637586/payload Regression since: b22ce90d42
Showing the changes to libavcodec (1 of 1 file). Show all
Unified · Split
| @@ -1601,6 +1601,11 @@ static int old_codec48(SANMVideoContext *ctx, int width, int height) · 1600 unmodified lines | |||
| 1601 | } | 1601 | } |
| 1602 | break; | 1602 | break; |
| 1603 | case 2: | 1603 | case 2: |
| 1604 | if (decoded_size > ctx->buf_size) { | ||
| 1605 | av_log(ctx->avctx, AV_LOG_ERROR, "Decoded size %u is too large.\n", decoded_size); | ||
| 1606 | return AVERROR_INVALIDDATA; | ||
| 1607 | } | ||
| 1608 | |||
| 1604 | if (rle_decode(ctx, &ctx->gb, dst, decoded_size)) | 1609 | if (rle_decode(ctx, &ctx->gb, dst, decoded_size)) |
| 1605 | return AVERROR_INVALIDDATA; | 1610 | return AVERROR_INVALIDDATA; |
| 1606 | break; | 1611 | break; |