Commit e9757915 authored by James Zern's avatar James Zern Committed by Gerrit Code Review

Merge "vp9_dx_iface: subtract ptrs to validate frame_size"

parents 6d065ba3 a8cfbbe3
......@@ -413,7 +413,8 @@ static vpx_codec_err_t decoder_decode(vpx_codec_alg_priv_t *ctx,
for (i = 0; i < frame_count; ++i) {
const uint32_t frame_size = frame_sizes[i];
if (data_start < data || data_start + frame_size >= data_end) {
if (data_start < data ||
frame_size > (uint32_t)(data_end - data_start)) {
ctx->base.err_detail = "Invalid frame size in index";
return VPX_CODEC_CORRUPT_FRAME;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment