[FFmpeg-cvslog] indeo3: add out-of-buffer write check

[Stefano Sabatini]

ffmpeg | branch: master | Stefano Sabatini <stefano.sabatini-lala at poste.it> | Tue May 17 22:21:33 2011 +0200| [48df6a241532f0702fc4fd10ddcbfac435e4027c] | committer: Stefano Sabatini

indeo3: add out-of-buffer write check

Prevent out-of-buffer writes. In particular fix smclocki32.avi.1.1
crash, trac issue #114, roundup issue #1482.

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=48df6a241532f0702fc4fd10ddcbfac435e4027c
---

 libavcodec/indeo3.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index b74fcf7..8e55fbe 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -213,6 +213,7 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
     int *width_tbl, width_tbl_arr[10];
     const signed char *ref_vectors;
     uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2;
+    uint8_t *cur_end = cur + width*height + width;
     uint32_t *cur_lp, *ref_lp;
     const uint32_t *correction_lp[2], *correctionloworder_lp[2], *correctionhighorder_lp[2];
     uint8_t *correction_type_sp[2];
@@ -359,6 +360,8 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
                             k = *buf1++;
                             cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2];
                             ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2];
+                            if ((uint8_t *)cur_lp >= cur_end-3)
+                                break;
 
                             switch(correction_type_sp[0][k]) {
                             case 0: