Browse Source

avcodec/bmp: fix integer overflow in checking header sizes

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
tags/n2.3
Michael Niedermayer 11 years ago
parent
commit
bd8b6ed96d
1 changed files with 1 additions and 1 deletions
  1. +1
    -1
      libavcodec/bmp.c

+ 1
- 1
libavcodec/bmp.c View File

@@ -70,7 +70,7 @@ static int bmp_decode_frame(AVCodecContext *avctx,


hsize = bytestream_get_le32(&buf); /* header size */ hsize = bytestream_get_le32(&buf); /* header size */
ihsize = bytestream_get_le32(&buf); /* more header size */ ihsize = bytestream_get_le32(&buf); /* more header size */
if (ihsize + 14 > hsize) {
if (ihsize + 14LL > hsize) {
av_log(avctx, AV_LOG_ERROR, "invalid header size %u\n", hsize); av_log(avctx, AV_LOG_ERROR, "invalid header size %u\n", hsize);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }


Loading…
Cancel
Save