From a8cfbbe33f0e43554eef93660610b70b42d1fcf3 Mon Sep 17 00:00:00 2001
From: James Zern <jzern@google.com>
Date: Thu, 8 May 2014 20:20:20 -0700
Subject: [PATCH] vp9_dx_iface: subtract ptrs to validate frame_size
Change-Id: Ic5a6a4a2fec802d9c9c7a71dbae59d5b4d3a8b23
---
vp9/vp9_dx_iface.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/vp9/vp9_dx_iface.c b/vp9/vp9_dx_iface.c
index b5b0340a10..963c764c03 100644
--- a/vp9/vp9_dx_iface.c
+++ b/vp9/vp9_dx_iface.c
@@ -417,7 +417,8 @@ static vpx_codec_err_t decoder_decode(vpx_codec_alg_priv_t *ctx,
for (i = 0; i < frame_count; ++i) {
const uint32_t frame_size = frame_sizes[i];
- if (data_start < data || data_start + frame_size >= data_end) {
+ if (data_start < data ||
+ frame_size > (uint32_t)(data_end - data_start)) {
ctx->base.err_detail = "Invalid frame size in index";
return VPX_CODEC_CORRUPT_FRAME;
}
--
GitLab