avcodec/dvdsubdec: Fix buf_size check
authorMichael Niedermayer <michael@niedermayer.cc>
Wed, 26 Oct 2016 14:29:57 +0000 (16:29 +0200)
committerMichael Niedermayer <michael@niedermayer.cc>
Sat, 26 Nov 2016 14:12:26 +0000 (15:12 +0100)
Fixes out of array access

Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 25ab1a65f3acb5ec67b53fb7a2463a7368f1ad16)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/dvdsubdec.c

index f009824..7fa117d 100644 (file)
@@ -516,7 +516,8 @@ static int append_to_cached_buf(AVCodecContext *avctx,
 {
     DVDSubContext *ctx = avctx->priv_data;
 
-    if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
+    av_assert0(buf_size >= 0 && ctx->buf_size <= sizeof(ctx->buf));
+    if (buf_size >= sizeof(ctx->buf) - ctx->buf_size) {
         av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
                "too large SPU packets aborted.\n");
         ctx->buf_size = 0;