From 25ab1a65f3acb5ec67b53fb7a2463a7368f1ad16 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Wed, 26 Oct 2016 16:29:57 +0200
Subject: [PATCH] avcodec/dvdsubdec: Fix buf_size check
Fixes out of array access
Found-by: Thomas Garnier using libFuzzer
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dvdsubdec.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index b81b481e437..6cb612bb954 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -548,7 +548,8 @@ static int append_to_cached_buf(AVCodecContext *avctx,
{
DVDSubContext *ctx = avctx->priv_data;
- if (ctx->buf_size >= sizeof(ctx->buf) - buf_size) {
+ av_assert0(buf_size >= 0 && ctx->buf_size <= sizeof(ctx->buf));
+ if (buf_size >= sizeof(ctx->buf) - ctx->buf_size) {
av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
"too large SPU packets aborted.\n");
ctx->buf_size = 0;
--
GitLab