diff options
| author | Michael Niedermayer | 2013-11-26 21:53:47 +0100 |
|---|---|---|
| committer | Michael Niedermayer | 2013-11-27 00:10:23 +0100 |
| commit | 6d9dad6a7cb5d544d540abf941fedbd34c14d2bd (patch) | |
| tree | 766246a4271ee94634d3025802ee554e9a1e1a37 /libavcodec/g2meet.c | |
| parent | 83f7bd6dcf00875725c5f3b7e1bedac5a6b3c77d (diff) | |
avcodec/g2meet: check available space before copying palette
Fixes out of array read
Fixes: asan_heap-uaf_ae6067_5415_g2m4.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/g2meet.c')
| -rw-r--r-- | libavcodec/g2meet.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c index 663028fdf9..4f26258973 100644 --- a/libavcodec/g2meet.c +++ b/libavcodec/g2meet.c @@ -375,6 +375,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y, src += 3; } npal = *src++ + 1; + if (src_end - src < npal * 3) + return AVERROR_INVALIDDATA; memcpy(pal, src, npal * 3); src += npal * 3; if (sub_type != 2) { for (i = 0; i < npal; i++) { |