avcodec/ansi: Check x/y
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 2 May 2013 00:15:03 +0000 (02:15 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 15 Jan 2014 23:45:07 +0000 (00:45 +0100)
This prevents out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit e91fd754c63de7fd3cb7fdea8974166db362e387)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/ansi.c

index 51339d2..655c869 100644 (file)
@@ -239,6 +239,8 @@ static int execute_code(AVCodecContext * avctx, int c)
         default:
             av_log_ask_for_sample(avctx, "unsupported screen mode\n");
         }
+        s->x = av_clip(s->x, 0, width  - FONT_WIDTH);
+        s->y = av_clip(s->y, 0, height - s->font_height);
         if (width != avctx->width || height != avctx->height) {
             if (s->frame.data[0])
                 avctx->release_buffer(avctx, &s->frame);
@@ -335,6 +337,8 @@ static int execute_code(AVCodecContext * avctx, int c)
         av_log_ask_for_sample(avctx, "unsupported escape code\n");
         break;
     }
+    s->x = av_clip(s->x, 0, avctx->width  - FONT_WIDTH);
+    s->y = av_clip(s->y, 0, avctx->height - s->font_height);
     return 0;
 }