From ca6c3f2c53be70aa3c38e8f1292809db89ea1ba6 Mon Sep 17 00:00:00 2001
From: Xi Wang <xi.wang@gmail.com>
Date: Fri, 15 Mar 2013 06:59:22 -0400
Subject: [PATCH] lzo: fix overflow checking in copy_backptr()
The check `src > dst' in the form `&c->out[-back] > c->out' invokes
pointer overflow, which is undefined behavior in C.
Remove the check. Also replace `&c->out[-back] < c->out_start' with
a safe form `c->out - c->out_start < back' to avoid overflow.
CC: libav-stable@libav.org
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
---
libavutil/lzo.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index eff3cd2333c..5c5ebc850ad 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -110,9 +110,8 @@ static inline void copy(LZOContext *c, int cnt)
*/
static inline void copy_backptr(LZOContext *c, int back, int cnt)
{
- register const uint8_t *src = &c->out[-back];
register uint8_t *dst = c->out;
- if (src < c->out_start || src > dst) {
+ if (dst - c->out_start < back) {
c->error |= AV_LZO_INVALID_BACKPTR;
return;
}
--
GitLab