vp7: bound checking in vp7_decode_frame_header
authorFederico Tomassetti <federico@tomassetti.me>
Thu, 13 Aug 2015 13:35:53 +0000 (15:35 +0200)
committerLuca Barbato <lu_zero@gentoo.org>
Sun, 16 Aug 2015 17:02:16 +0000 (19:02 +0200)
CC: libav-stable@libav.org
libavcodec/vp8.c

index f11076a..55ebae6 100644 (file)
@@ -480,6 +480,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
     int width  = s->avctx->width;
     int height = s->avctx->height;
 
+    if (buf_size < 4) {
+        return AVERROR_INVALIDDATA;
+    }
+
     s->profile = (buf[0] >> 1) & 7;
     if (s->profile > 1) {
         avpriv_request_sample(s->avctx, "Unknown profile %d", s->profile);
@@ -493,6 +497,10 @@ static int vp7_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
     buf      += 4 - s->profile;
     buf_size -= 4 - s->profile;
 
+    if (buf_size < part1_size) {
+        return AVERROR_INVALIDDATA;
+    }
+
     memcpy(s->put_pixels_tab, s->vp8dsp.put_vp8_epel_pixels_tab, sizeof(s->put_pixels_tab));
 
     ff_vp56_init_range_decoder(c, buf, part1_size);