pgssubdec: Check RLE size before copying
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 31 Jul 2014 01:31:19 +0000 (21:31 -0400)
committerDiego Biurrun <diego@biurrun.de>
Fri, 1 Aug 2014 08:04:13 +0000 (01:04 -0700)
commita1f7844a11010d8552c75424d1a831b37a0ae5d9
tree84ddc391a0e696472540d209a74b3721671e687f
parentd396987c303bdc4eea7d1a1ff6776475d9bbd9ea
pgssubdec: Check RLE size before copying

Make sure the buffer size does not exceed the expected
RLE size.

Prevent an out of array bound write.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Bug-Id: CVE-2013-0852

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
(cherry picked from commit d98e6c5d5d80c1dfe0c30f2e73d41a3aea0b920d)
Signed-off-by: Diego Biurrun <diego@biurrun.de>
libavcodec/pgssubdec.c