dany/libwebp
1
0
Fork 0
mirror of https://github.com/webmproject/libwebp.git synced 2024-12-27 06:08:21 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

VPLBitReader bugfix: Catch error if bit_pos > LBITS too.

Browse Source 
Earlier we were only testing for bit_pos == LBITS. But this is not
sufficient,
as bit_pos can jump from < LBITS to > LBITS.

This was resulting in some bit-stream truncation errors not being
caught.

Note: Not a security bug though, as br->pos wasn't incremented in such
cases
and so we weren't reading beyond the buffer.

Change-Id: Idadcdcbc6a5713f8fac3470f907fa37a63074836
This commit is contained in:
Urvang Joshi 2013-10-30 16:33:36 -07:00
parent 1e898619cb
commit 96ad0e0aef
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/utils/bit_reader.c
View File

@ -179,7 +179,7 @@ void VP8LFillBitWindow(VP8LBitReader* const br) {
}
#endif
ShiftBytes(br); // Slow path.
if (br->pos_ == br->len_ && br->bit_pos_ == LBITS) {
if (br->pos_ == br->len_ && br->bit_pos_ >= LBITS) {
br->eos_ = 1;
}
}