git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
c3ece52
)
avutil/lzo: Fix integer overflow
author
Michael Niedermayer
<michaelni@gmx.at>
Fri, 20 Jun 2014 01:15:28 +0000
(
03:15
+0200)
committer
Michael Niedermayer
<michaelni@gmx.at>
Wed, 11 Mar 2015 23:43:38 +0000
(
00:43
+0100)
Embargoed-till: 2014-06-27 requested by researcher, but embargo broken by libav today (git and mailing list)
Fixes: LMS-2014-06-16-4
Found-by: "Don A. Bailey" <donb@securitymouse.com>
See:
ccda51b14c0fcae2fad73a24872dce75a7964996
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit
d6af26c55c1ea30f85a7d9edbc373f53be1743ee
)
Conflicts:
libavutil/lzo.c
(cherry picked from commit
7b5c706494a775b2b0d0e0a38448610802eef8f4
)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavutil/lzo.c
patch
|
blob
|
history
diff --git
a/libavutil/lzo.c
b/libavutil/lzo.c
index
d2e86bc
..
d91fbfc
100644
(file)
--- a/
libavutil/lzo.c
+++ b/
libavutil/lzo.c
@@
-62,7
+62,13
@@
static inline int get_byte(LZOContext *c) {
static inline int get_len(LZOContext *c, int x, int mask) {
int cnt = x & mask;
if (!cnt) {
- while (!(x = get_byte(c))) cnt += 255;
+ while (!(x = get_byte(c))) {
+ if (cnt >= INT_MAX - 1000) {
+ c->error |= AV_LZO_ERROR;
+ break;
+ }
+ cnt += 255;
+ }
cnt += mask + x;
}
return cnt;