lzw: prevent buffer overreads.
authorRonald S. Bultje <rsbultje@gmail.com>
Thu, 29 Mar 2012 00:06:00 +0000 (17:06 -0700)
committerRonald S. Bultje <rsbultje@gmail.com>
Thu, 29 Mar 2012 00:38:51 +0000 (17:38 -0700)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavcodec/lzw.c

index 873b314..b674d4e 100644 (file)
@@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p)
     struct LZWState *s = (struct LZWState *)p;
 
     if(s->mode == FF_LZW_GIF) {
-        while(s->pbuf < s->ebuf && s->bs>0){
-            s->pbuf += s->bs;
-            s->bs = *s->pbuf++;
+        while (s->bs > 0) {
+            if (s->pbuf + s->bs >= s->ebuf) {
+                s->pbuf = s->ebuf;
+                break;
+            } else {
+                s->pbuf += s->bs;
+                s->bs = *s->pbuf++;
+            }
         }
     }else
         s->pbuf= s->ebuf;