Merge commit 'e930b112d14d7acd050d5087d11b6dd4c56a8e4e' into release/0.10
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 4 Nov 2013 17:04:22 +0000 (18:04 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 4 Nov 2013 17:04:29 +0000 (18:04 +0100)
* commit 'e930b112d14d7acd050d5087d11b6dd4c56a8e4e':
  oma: refactor seek function
  8bps: Bound-check the input buffer
  rtmp: Do not misuse memcmp

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/8bps.c
libavformat/omadec.c
libavformat/rtmppkt.c
libavformat/rtmppkt.h
libavformat/rtmpproto.c

@@@ -69,8 -69,9 +69,8 @@@ static int decode_frame(AVCodecContext 
          unsigned char *pixptr, *pixptr_end;
          unsigned int height = avctx->height; // Real image height
          unsigned int dlen, p, row;
-         const unsigned char *lp, *dp;
+         const unsigned char *lp, *dp, *ep;
          unsigned char count;
 -        unsigned int px_inc;
          unsigned int planes = c->planes;
          unsigned char *planemap = c->planemap;
  
                                  if ((count = *dp++) <= 127) {
                                          count++;
                                          dlen -= count + 1;
 -                                        if (pixptr + count * px_inc > pixptr_end)
 +                                        if (pixptr + count * planes > pixptr_end)
                                              break;
-                                         if(dp + count > buf+buf_size) return -1;
+                                         if(ep - dp < count) return -1;
                                          while(count--) {
                                                  *pixptr = *dp++;
 -                                                pixptr += px_inc;
 +                                                pixptr += planes;
                                          }
                                  } else {
                                          count = 257 - count;
Simple merge
Simple merge
Simple merge
Simple merge