This macro unconditionally used out[-1], which causes an out of bounds
read, if out is the very beginning of the buffer.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavcodec/exr.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/libavcodec/exr.c b/libavcodec/exr.c
index 86a9908..cf28374 100644
--- a/libavcodec/exr.c
+++ b/libavcodec/exr.c
@@ -461,7 +461,7 @@ static int huf_build_dec_table(const uint64_t *hcode, int
im,
lc += 8; \
}
-#define get_code(po, rlc, c, lc, gb, out, oe) \
+#define get_code(po, rlc, c, lc, gb, out, oe, outb) \
{ \
if (po == rlc) { \
if (lc < 8) \
@@ -470,7 +470,7 @@ static int huf_build_dec_table(const uint64_t *hcode, int
im,
\
cs = c >> lc; \
\
- if (out + cs > oe) \
+ if (out + cs > oe || out == outb) \
return AVERROR_INVALIDDATA; \
\
s = out[-1]; \
@@ -503,7 +503,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec
*hdecod,
if (pl.len) {
lc -= pl.len;
- get_code(pl.lit, rlc, c, lc, gb, out, oe);
+ get_code(pl.lit, rlc, c, lc, gb, out, oe, outb);
} else {
int j;
@@ -520,7 +520,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec
*hdecod,
if ((hcode[pl.p[j]] >> 6) ==
((c >> (lc - l)) & ((1LL << l) - 1))) {
lc -= l;
- get_code(pl.p[j], rlc, c, lc, gb, out, oe);
+ get_code(pl.p[j], rlc, c, lc, gb, out, oe, outb);
break;
}
}
@@ -541,7 +541,7 @@ static int huf_decode(const uint64_t *hcode, const HufDec
*hdecod,
if (pl.len) {
lc -= pl.len;
- get_code(pl.lit, rlc, c, lc, gb, out, oe);
+ get_code(pl.lit, rlc, c, lc, gb, out, oe, outb);
} else {
return AVERROR_INVALIDDATA;
}
--
2.6.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
