[FFmpeg-cvslog] cdgraphics: Fix out of array write

[Michael Niedermayer]

ffmpeg | branch: release/0.7 | Michael Niedermayer <michaelni at gmx.at> | Mon May 28 16:50:15 2012 +0200| [0aefcb6aa86b80729b2475d192940801892d97ff] | committer: Michael Niedermayer

cdgraphics: Fix out of array write

Fixes Ticket1359

Found-by: Piotr Bandurski <ami_stuff at o2.pl>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 1e5c7376c4ed733910845c9a09e272ac7696b1f4)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=0aefcb6aa86b80729b2475d192940801892d97ff
---

 libavcodec/cdgraphics.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/cdgraphics.c b/libavcodec/cdgraphics.c
index aae7bbb..3edeefc 100644
--- a/libavcodec/cdgraphics.c
+++ b/libavcodec/cdgraphics.c
@@ -280,6 +280,10 @@ static int cdg_decode_frame(AVCodecContext *avctx,
         av_log(avctx, AV_LOG_ERROR, "buffer too small for decoder\n");
         return AVERROR(EINVAL);
     }
+    if (buf_size > CDG_HEADER_SIZE + CDG_DATA_SIZE) {
+        av_log(avctx, AV_LOG_ERROR, "buffer too big for decoder\n");
+        return AVERROR(EINVAL);
+    }
 
     ret = avctx->reget_buffer(avctx, &cc->frame);
     if (ret) {