avcodec/sunrast: Fix input buffer pointer check
authorMichael Niedermayer <michael@niedermayer.cc>
Tue, 1 Nov 2016 18:24:49 +0000 (19:24 +0100)
committerMichael Niedermayer <michael@niedermayer.cc>
Mon, 5 Dec 2016 17:29:12 +0000 (18:29 +0100)
Fixes: out of array read
Fixes: poc.dat

Found-by: Bingchang, Liu @VARAS of IIE
Tested-by: bc L <l.bing.chang.bc@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 37138338ff602803d174b13fecd363a083bc2f9a)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
libavcodec/sunrast.c

index 25e11f6..0af5626 100644 (file)
@@ -168,7 +168,7 @@ static int sunrast_decode_frame(AVCodecContext *avctx, void *data,
         }
     } else {
         for (y = 0; y < h; y++) {
-            if (buf_end - buf < len)
+            if (buf_end - buf < alen)
                 break;
             memcpy(ptr, buf, len);
             ptr += stride;