avformat/paf: Fix integer overflow and out of array read
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Aug 2013 11:23:10 +0000 (13:23 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 9 Aug 2013 11:53:27 +0000 (13:53 +0200)
Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f58cd2867a8af2eed13acdd21d067b48249b14a1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/paf.c

index 09786eb..09aefe6 100644 (file)
@@ -233,10 +233,11 @@ static int read_packet(AVFormatContext *s, AVPacket *pkt)
         p->current_frame_block++;
     }
 
-    size = p->video_size - p->frames_offset_table[p->current_frame];
-    if (size < 1)
+    if (p->frames_offset_table[p->current_frame] >= p->video_size)
         return AVERROR_INVALIDDATA;
 
+    size = p->video_size - p->frames_offset_table[p->current_frame];
+
     if (av_new_packet(pkt, size) < 0)
         return AVERROR(ENOMEM);