[FFmpeg-cvslog] g2meet: Check cursor parameters before writing them in the context

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Jun  9 11:59:57 2013 +0200| [ada497e61660b4a23d49eaf07fe19386573a6ba9] | committer: Michael Niedermayer

g2meet: Check cursor parameters before writing them in the context

Fixes out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=ada497e61660b4a23d49eaf07fe19386573a6ba9
---

 libavcodec/g2meet.c |   16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index 8eb310b..a5edc33 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -601,6 +601,7 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
     int chunk_type;
     int i;
     int ret;
+    int cursor_w, cursor_h, cursor_hot_x, cursor_hot_y, cursor_fmt;
 
     if (buf_size < 12) {
         av_log(avctx, AV_LOG_ERROR,
@@ -732,17 +733,22 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
             bytestream2_init(&tbc, buf + bytestream2_tell(&bc),
                              chunk_size - 4);
             cur_size        = bytestream2_get_be32(&tbc);
-            c->cursor_w     = bytestream2_get_byte(&tbc);
-            c->cursor_h     = bytestream2_get_byte(&tbc);
-            c->cursor_hot_x = bytestream2_get_byte(&tbc);
-            c->cursor_hot_y = bytestream2_get_byte(&tbc);
-            c->cursor_fmt   = bytestream2_get_byte(&tbc);
+            cursor_w        = bytestream2_get_byte(&tbc);
+            cursor_h        = bytestream2_get_byte(&tbc);
+            cursor_hot_x    = bytestream2_get_byte(&tbc);
+            cursor_hot_y    = bytestream2_get_byte(&tbc);
+            cursor_fmt      = bytestream2_get_byte(&tbc);
             if (cur_size >= chunk_size ||
                 c->cursor_w * c->cursor_h / 4 > cur_size) {
                 av_log(avctx, AV_LOG_ERROR, "Invalid cursor data size %d\n",
                        chunk_size);
                 break;
             }
+            c->cursor_w     = cursor_w;
+            c->cursor_h     = cursor_h;
+            c->cursor_hot_x = cursor_hot_x;
+            c->cursor_hot_y = cursor_hot_y;
+            c->cursor_fmt   = cursor_fmt;
             g2m_load_cursor(c, &tbc);
             bytestream2_skip(&bc, chunk_size);
             break;