X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;ds=sidebyside;f=libavutil%2Flzo.c;h=e458165261dbeef2736c3a378a96bbf21cecd52d;hb=52730e0f867fe77b7d2353d8b44e92edb7079ca5;hp=eff3cd2333cbfb990892da28b0a512f6390ce12d;hpb=5bac2d0c3020587a03cb14e8b6a664a0b92f26c2;p=ffmpeg

diff --git a/libavutil/lzo.c b/libavutil/lzo.c
index eff3cd2333c..e458165261d 100644
--- a/libavutil/lzo.c
+++ b/libavutil/lzo.c
@@ -80,6 +80,10 @@ static inline void copy(LZOContext *c, int cnt)
 {
     register const uint8_t *src = c->in;
     register uint8_t *dst       = c->out;
+    if (cnt < 0) {
+        c->error |= AV_LZO_ERROR;
+        return;
+    }
     if (cnt > c->in_end - src) {
         cnt       = FFMAX(c->in_end - src, 0);
         c->error |= AV_LZO_INPUT_DEPLETED;
@@ -103,16 +107,19 @@ static inline void copy(LZOContext *c, int cnt)
 /**
  * @brief Copies previously decoded bytes to current position.
  * @param back how many bytes back we start
- * @param cnt number of bytes to copy, must be >= 0
+ * @param cnt number of bytes to copy, must be > 0
  *
  * cnt > back is valid, this will copy the bytes we just copied,
  * thus creating a repeating pattern with a period length of back.
  */
 static inline void copy_backptr(LZOContext *c, int back, int cnt)
 {
-    register const uint8_t *src = &c->out[-back];
     register uint8_t *dst       = c->out;
-    if (src < c->out_start || src > dst) {
+    if (cnt <= 0) {
+        c->error |= AV_LZO_ERROR;
+        return;
+    }
+    if (dst - c->out_start < back) {
         c->error |= AV_LZO_INVALID_BACKPTR;
         return;
     }