[FFmpeg-cvslog] avcodec/iff: Check that there are enough bytes in dgb before reading

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michael at niedermayer.cc> | Mon Jul 11 14:48:03 2016 +0200| [a2550e7d2e4c1e2f1fd262985a1d789240f7e839] | committer: Michael Niedermayer

avcodec/iff: Check that there are enough bytes in dgb before reading

Fixes CID1361959

Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a2550e7d2e4c1e2f1fd262985a1d789240f7e839
---

 libavcodec/iff.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/iff.c b/libavcodec/iff.c
index 141acc7..676d062 100644
--- a/libavcodec/iff.c
+++ b/libavcodec/iff.c
@@ -1388,6 +1388,8 @@ static void decode_delta_l(uint8_t *dst,
 
             offset = ((2 * offset) / planepitch_byte) * pitch + ((2 * offset) % planepitch_byte) + k * planepitch;
             if (cnt < 0) {
+                if (bytestream2_get_bytes_left(&dgb) < 2)
+                    break;
                 bytestream2_seek_p(&pb, offset, SEEK_SET);
                 cnt = -cnt;
                 data = bytestream2_get_be16(&dgb);
@@ -1396,6 +1398,8 @@ static void decode_delta_l(uint8_t *dst,
                     bytestream2_skip_p(&pb, dstpitch - 2);
                 }
             } else {
+                if (bytestream2_get_bytes_left(&dgb) < 2*cnt)
+                    break;
                 bytestream2_seek_p(&pb, offset, SEEK_SET);
                 for (i = 0; i < cnt; i++) {
                     data = bytestream2_get_be16(&dgb);