From b08edb22684c1848b1c6186848585c324d9aae62 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Reimar=20D=C3=B6ffinger?= Date: Sun, 13 Jul 2008 20:03:57 +0000 Subject: [PATCH] check that csize in ff_lzw_decode_init is < LZW_MAXBITS, <= is not enough and might read outside the prefix array Originally committed as revision 14214 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/lzw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c index 207b807e9..7bdc89a37 100644 --- a/libavcodec/lzw.c +++ b/libavcodec/lzw.c @@ -131,7 +131,7 @@ int ff_lzw_decode_init(LZWState *p, int csize, const uint8_t *buf, int buf_size, { struct LZWState *s = (struct LZWState *)p; - if(csize < 1 || csize > LZW_MAXBITS) + if(csize < 1 || csize >= LZW_MAXBITS) return -1; /* read buffer */ s->pbuf = buf; -- 2.11.0