You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
36 lines
738 B
36 lines
738 B
10 years ago
|
Description: Fix buffer overflow causing an invalid pointer free().
|
||
|
|
Author: Guillem Jover <guillem@debian.org>
|
||
|
|
Origin: vendor
|
||
|
|
Bug-Debian: https://bugs.debian.org/774015
|
||
|
|
Forwarded: no
|
||
|
|
Last-Update: 2015-02-26
|
||
|
|
|
||
|
|
---
|
||
|
|
decode.c | 6 +++---
|
||
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
||
|
|
|
||
|
|
--- a/decode.c
|
||
|
|
+++ b/decode.c
|
||
|
|
@@ -255,7 +255,7 @@ void read_pt_len(int nn, int nbit, int i
|
||
|
|
if(i==i_special)
|
||
|
|
{
|
||
|
|
c=getbits(2);
|
||
|
|
- while(--c>=0)
|
||
|
|
+ while(--c>=0&&i<nn)
|
||
|
|
pt_len[i++]=0;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
@@ -314,10 +314,10 @@ void read_c_len()
|
||
|
|
c=getbits(CBIT);
|
||
|
|
c+=20;
|
||
|
|
}
|
||
|
|
- while(--c>=0)
|
||
|
|
+ while(--c>=0&&i<NC)
|
||
|
|
c_len[i++]=0;
|
||
|
|
}
|
||
|
|
- else
|
||
|
|
+ else if (i<NC)
|
||
|
|
c_len[i++]=(unsigned char)(c-2);
|
||
|
|
}
|
||
|
|
while(i<NC)
|