commit acf511de34e0b79fff0183e06ed37f1aa8dc3d94
author Michael Niedermayer <michaelni@gmx.at> Wed Aug 07 15:50:26 2013 +0200
committer Michael Niedermayer <michaelni@gmx.at> Sun Aug 11 00:14:17 2013 +0200
tree de141e188a86249b93af7ebc42281b381baa592d
parent fd2951bb53b3096a90307945fa074da9f9980d55

avcodec/g2meet: fix src pointer checks in kempf_decode_tile()

Fixes Ticket2842

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 2960576378d17d71cc8dccc926352ce568b5eec1)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

libavcodec/g2meet.c

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index bc01dfa..d31fc54 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -389,7 +389,7 @@
         return 0;
     zsize = (src[0] << 8) | src[1]; src += 2;
 
-    if (src_end - src < zsize)
+    if (src_end - src < zsize + (sub_type != 2))
         return AVERROR_INVALIDDATA;
 
     ret = uncompress(c->kempf_buf, &dlen, src, zsize);
@@ -411,6 +411,8 @@
     for (i = 0; i < (FFALIGN(height, 16) >> 4); i++) {
         for (j = 0; j < (FFALIGN(width, 16) >> 4); j++) {
             if (!bits) {
+                if (src >= src_end)
+                    return AVERROR_INVALIDDATA;
                 bitbuf = *src++;
                 bits   = 8;
             }