From: Kostya Shishkov <kostya.shishkov@gmail.com>
Date: Tue, 2 Dec 2008 17:39:20 +0000 (+0000)
Subject: Check RV30/40 slice offsets to be inside buffer.
X-Git-Tag: v0.5~1812
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=1799d5223eba3eb8f5ae1f1db71674af9dabcb6a;p=platform%2Fupstream%2Flibav.git

Check RV30/40 slice offsets to be inside buffer.

This fixes issue 738

Originally committed as revision 15981 to svn://svn.ffmpeg.org/ffmpeg/trunk
---

diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
index 297a1a7..ec80035 100644
--- a/libavcodec/rv34.c
+++ b/libavcodec/rv34.c
@@ -1389,6 +1389,11 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
         else
             size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
 
+        if(offset > buf_size){
+            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
+            break;
+        }
+
         r->si.end = s->mb_width * s->mb_height;
         if(i+1 < slice_count){
             init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, i+1), (buf_size-get_slice_offset(avctx, slices_hdr, i+1))*8);