Merge commit 'dd0bfc3a6a310e3e3674ce7742672d689a9a0e93'
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 21 Jul 2013 09:55:51 +0000 (11:55 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 21 Jul 2013 09:59:16 +0000 (11:59 +0200)
* commit 'dd0bfc3a6a310e3e3674ce7742672d689a9a0e93':
  dsicinav: Bound-check the source buffer when needed

Conflicts:
libavcodec/dsicinav.c

See: 47f0beadba9003391d8bfef59b15aa21a5b2d293
Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/dsicinav.c

@@@ -218,11 -201,7 +218,11 @@@ static int cin_decode_rle(const unsigne
              memset(dst, *src++, FFMIN(len, dst_end - dst));
          } else {
              len = code + 1;
-             memcpy(dst, src, FFMIN(len, dst_end - dst));
 +            if (len > src_end-src) {
 +                av_log(NULL, AV_LOG_ERROR, "RLE overread\n");
 +                return AVERROR_INVALIDDATA;
 +            }
+             memcpy(dst, src, FFMIN3(len, dst_end - dst, src_end - src));
              src += len;
          }
          dst += len;