The check `src > dst' in the form `&c->out[-back] > c->out' invokes pointer overflow, which is undefined behavior in C. Remove the check. Also replace `&c->out[-back] < c->out_start' with a safe form `c->out - c->out_start < back' to avoid overflow. CC: libav-stable@libav.org
Unified · Split
| @@ -110,9 +110,8 @@ static inline void copy(LZOContext *c, int cnt) · 109 unmodified lines | |||
| 110 | */ | 110 | */ |
| 111 | static inline void copy_backptr(LZOContext *c, int back, int cnt) | 111 | static inline void copy_backptr(LZOContext *c, int back, int cnt) |
| 112 | { | 112 | { |
| 113 | register const uint8_t *src = &c->out[-back]; | ||
| 114 | register uint8_t *dst = c->out; | 113 | register uint8_t *dst = c->out; |
| 115 | if (src < c->out_start || src > dst) { | 114 | if (dst - c->out_start < back) { |
| 116 | c->error |= AV_LZO_INVALID_BACKPTR; | 115 | c->error |= AV_LZO_INVALID_BACKPTR; |
| 117 | return; | 116 | return; |
| 118 | } | 117 | } |