From: benoit <benoit@9553f0bf-9b14-0410-a0b8-cfaf0461ba5b>
Date: Mon, 26 Jan 2009 09:41:23 +0000 (+0000)
Subject: Fix an exploit in indeo by checking we are not writing out of the strip array.
X-Git-Url: https://rtime.felk.cvut.cz/gitweb/frescor/ffmpeg.git/commitdiff_plain/3c078bc672290856138c4462527d0358aa693d51

Fix an exploit in indeo by checking we are not writing out of the strip array.
Fixes issue 655


git-svn-id: file:///var/local/repositories/ffmpeg/trunk@16802 9553f0bf-9b14-0410-a0b8-cfaf0461ba5b
---

diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
index eea27f927..d041be75e 100644
--- a/libavcodec/indeo3.c
+++ b/libavcodec/indeo3.c
@@ -252,6 +252,10 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
 
         if(cmd == 0) {
             strip++;
+            if(strip >= strip_tbl + FF_ARRAY_ELEMS(strip_tbl)) {
+                av_log(s->avctx, AV_LOG_WARNING, "out of range strip\n");
+                break;
+            }
             memcpy(strip, strip-1, sizeof(*strip));
             strip->split_flag = 1;
             strip->split_direction = 0;
@@ -259,6 +263,10 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
             continue;
         } else if(cmd == 1) {
             strip++;
+            if(strip >= strip_tbl + FF_ARRAY_ELEMS(strip_tbl)) {
+                av_log(s->avctx, AV_LOG_WARNING, "out of range strip\n");
+                break;
+            }
             memcpy(strip, strip-1, sizeof(*strip));
             strip->split_flag = 1;
             strip->split_direction = 1;