From 271f5d68b922174e5b49df9778c89ee76b105c60 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 2 May 2013 02:15:03 +0200 Subject: [PATCH] avcodec/ansi: Check x/y This prevents out of array accesses Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer (cherry picked from commit e91fd754c63de7fd3cb7fdea8974166db362e387) Signed-off-by: Michael Niedermayer --- libavcodec/ansi.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/ansi.c b/libavcodec/ansi.c index 51339d24f9..655c86970c 100644 --- a/libavcodec/ansi.c +++ b/libavcodec/ansi.c @@ -239,6 +239,8 @@ static int execute_code(AVCodecContext * avctx, int c) default: av_log_ask_for_sample(avctx, "unsupported screen mode\n"); } + s->x = av_clip(s->x, 0, width - FONT_WIDTH); + s->y = av_clip(s->y, 0, height - s->font_height); if (width != avctx->width || height != avctx->height) { if (s->frame.data[0]) avctx->release_buffer(avctx, &s->frame); @@ -335,6 +337,8 @@ static int execute_code(AVCodecContext * avctx, int c) av_log_ask_for_sample(avctx, "unsupported escape code\n"); break; } + s->x = av_clip(s->x, 0, avctx->width - FONT_WIDTH); + s->y = av_clip(s->y, 0, avctx->height - s->font_height); return 0; }