diff options
Diffstat (limited to 'vp8/decoder/decodframe.c')
| -rw-r--r-- | vp8/decoder/decodframe.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/vp8/decoder/decodframe.c b/vp8/decoder/decodframe.c index 2d81d61d5..f5e49a147 100644 --- a/vp8/decoder/decodframe.c +++ b/vp8/decoder/decodframe.c @@ -462,7 +462,8 @@ static void setup_token_decoder(VP8D_COMP *pbi, partition_size = user_data_end - partition; } - if (user_data_end - partition < partition_size) + if (partition + partition_size > user_data_end + || partition + partition_size < partition) vpx_internal_error(&pc->error, VPX_CODEC_CORRUPT_FRAME, "Truncated packet or corrupt partition " "%d length", i + 1); @@ -580,7 +581,8 @@ int vp8_decode_frame(VP8D_COMP *pbi) (data[0] | (data[1] << 8) | (data[2] << 16)) >> 5; data += 3; - if (data_end - data < first_partition_length_in_bytes) + if (data + first_partition_length_in_bytes > data_end + || data + first_partition_length_in_bytes < data) vpx_internal_error(&pc->error, VPX_CODEC_CORRUPT_FRAME, "Truncated packet or corrupt partition 0 length"); vp8_setup_version(pc); |