[FFmpeg-devel] [PATCH] indeo3: add out-of-buffer write check

[Stefano Sabatini]

Prevent out-of-buffer reads. In particular fix smclocki32.avi.1.1
crash, fix trac issue #114, roundup issue #1482.
---
 libavcodec/indeo3.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index fb33a7c..37124e4 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -208,6 +208,7 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
     int *width_tbl, width_tbl_arr[10];
     const signed char *ref_vectors;
     uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2;
+    uint8_t *cur_end = cur + width*height + width;
     uint32_t *cur_lp, *ref_lp;
     const uint32_t *correction_lp[2], *correctionloworder_lp[2], *correctionhighorder_lp[2];
     uint8_t *correction_type_sp[2];
@@ -354,6 +355,8 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
                             k = *buf1++;
                             cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2];
                             ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2];
+                            if ((uint8_t *)cur_lp >= cur_end)
+                                break;
 
                             switch(correction_type_sp[0][k]) {
                             case 0:
-- 
1.7.2.3