From ddcf67c8a51c67b122a826d8b5819e96d591d813 Mon Sep 17 00:00:00 2001
From: "Ronald S. Bultje" <rsbultje@gmail.com>
Date: Wed, 28 Mar 2012 17:06:00 -0700
Subject: [PATCH] lzw: prevent buffer overreads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
libavcodec/lzw.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c
index 873b31445bd..b674d4e296b 100644
--- a/libavcodec/lzw.c
+++ b/libavcodec/lzw.c
@@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p)
struct LZWState *s = (struct LZWState *)p;
if(s->mode == FF_LZW_GIF) {
- while(s->pbuf < s->ebuf && s->bs>0){
- s->pbuf += s->bs;
- s->bs = *s->pbuf++;
+ while (s->bs > 0) {
+ if (s->pbuf + s->bs >= s->ebuf) {
+ s->pbuf = s->ebuf;
+ break;
+ } else {
+ s->pbuf += s->bs;
+ s->bs = *s->pbuf++;
+ }
}
}else
s->pbuf= s->ebuf;
--
GitLab