xan: Check for out of bound reads in xan_huffman_decode()
Signed-off-by: Janne Grunau <janne-libav@jannau.net>
(cherry picked from commit 3db3fdf4c6)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
committed by
Reinhard Tartler
parent
0277c82de2
commit
49007b494e
@@ -112,7 +112,10 @@ static int xan_huffman_decode(unsigned char *dest, int dest_len,
|
||||
init_get_bits(&gb, ptr, ptr_len * 8);
|
||||
|
||||
while ( val != 0x16 ) {
|
||||
val = src[val - 0x17 + get_bits1(&gb) * byte];
|
||||
unsigned idx = val - 0x17 + get_bits1(&gb) * byte;
|
||||
if (idx >= 2 * byte)
|
||||
return -1;
|
||||
val = src[idx];
|
||||
|
||||
if ( val < 0x16 ) {
|
||||
if (dest >= dest_end)
|
||||
|
||||
Reference in New Issue
Block a user