[FFmpeg-cvslog] lzw: prevent buffer overreads.

[Ronald S. Bultje]

ffmpeg | branch: release/0.10 | Ronald S. Bultje <rsbultje at gmail.com> | Wed Mar 28 17:06:00 2012 -0700| [562c6a7bf129f0c8c49ad6bacc9674a9d2daa5ec] | committer: Reinhard Tartler

lzw: prevent buffer overreads.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
(cherry picked from commit ddcf67c8a51c67b122a826d8b5819e96d591d813)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=562c6a7bf129f0c8c49ad6bacc9674a9d2daa5ec
---

 libavcodec/lzw.c |   11 ++++++++---
 1 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/libavcodec/lzw.c b/libavcodec/lzw.c
index 873b314..b674d4e 100644
--- a/libavcodec/lzw.c
+++ b/libavcodec/lzw.c
@@ -101,9 +101,14 @@ void ff_lzw_decode_tail(LZWState *p)
     struct LZWState *s = (struct LZWState *)p;
 
     if(s->mode == FF_LZW_GIF) {
-        while(s->pbuf < s->ebuf && s->bs>0){
-            s->pbuf += s->bs;
-            s->bs = *s->pbuf++;
+        while (s->bs > 0) {
+            if (s->pbuf + s->bs >= s->ebuf) {
+                s->pbuf = s->ebuf;
+                break;
+            } else {
+                s->pbuf += s->bs;
+                s->bs = *s->pbuf++;
+            }
         }
     }else
         s->pbuf= s->ebuf;