Fix an exploit in indeo by checking we are not writing out of the strip array.

[ffmpeg] / libavcodec / libdiracdec.c

diff --git a/libavcodec/libdiracdec.c b/libavcodec/libdiracdec.c
index 06830f76d99d8bf4d6d55ab5a1d30948ed62c068..6c6e46708cc6f461ef4ebb84a38b18b520fc7709 100644 (file)
--- a/libavcodec/libdiracdec.c
+++ b/libavcodec/libdiracdec.c
@@ -88,10 +88,12 @@ static int libdirac_decode_frame(AVCodecContext *avccontext,
 
     *data_size = 0;
 
-    if (buf_size>0)
+    if (buf_size>0) {
         /* set data to decode into buffer */
         dirac_buffer (p_dirac_params->p_decoder, buf, buf+buf_size);
-
+        if ((buf[4] &0x08) == 0x08 && (buf[4] & 0x03))
+            avccontext->has_b_frames = 1;
+    }
     while (1) {
          /* parse data and process result */
         DecoderState state = dirac_parse (p_dirac_params->p_decoder);