From de41b555cdea2dcacbe98ee9edc83a8c15c73c4c Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Sun, 1 Nov 2015 04:07:47 +0100 Subject: truemotion2: Fix the buffer check The variable skip contains the expected size in bytes. Bug-Id: 906 CC: libav-stable@libav.org Signed-off-by: Luca Barbato --- libavcodec/truemotion2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 84e8e2a..1726440 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -291,7 +291,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i if (len == 0) return 4; - if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) { + if (len >= INT_MAX / 4 - 1 || len < 0 || skip > buf_size) { av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n"); return AVERROR_INVALIDDATA; } -- cgit v1.1