From e30b068ef79f604ff439418da07f7e2efd01d4ea Mon Sep 17 00:00:00 2001
From: Luca Barbato <lu_zero@gentoo.org>
Date: Fri, 28 Jun 2013 04:03:47 +0200
Subject: [PATCH] wmapro: make sure there is room to store the current packet
Prevent horrid and hard to trace struct overwrite.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
libavcodec/wmaprodec.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/libavcodec/wmaprodec.c b/libavcodec/wmaprodec.c
index 6a64641c871..8fdfbf866f2 100644
--- a/libavcodec/wmaprodec.c
+++ b/libavcodec/wmaprodec.c
@@ -1459,6 +1459,14 @@ static void save_bits(WMAProDecodeCtx *s, GetBitContext* gb, int len,
return;
}
+ if (len > put_bits_left(&s->pb)) {
+ av_log(s->avctx, AV_LOG_ERROR,
+ "Cannot append %d bits, only %d bits available.\n",
+ len, put_bits_left(&s->pb));
+ s->packet_loss = 1;
+ return;
+ }
+
s->num_saved_bits += len;
if (!append) {
avpriv_copy_bits(&s->pb, gb->buffer + (get_bits_count(gb) >> 3),
--
GitLab