Skip to content

Commit

Permalink
Fix boundary check on image buffers.
Browse files Browse the repository at this point in the history
  • Loading branch information
toots committed Sep 2, 2024
1 parent 7855ee2 commit 9b37004
Show file tree
Hide file tree
Showing 2 changed files with 4 additions and 3 deletions.
1 change: 1 addition & 0 deletions CHANGES
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
=====
* Deprecate `Encoder.eos`
* Add more exceptions.
* Fix boundary check for image buffers.

0.4.0 (08-03-2021)
======
Expand Down
6 changes: 3 additions & 3 deletions src/theora_stubs.c
Original file line number Diff line number Diff line change
Expand Up @@ -222,7 +222,7 @@ static void yuv_of_val(value v, th_ycbcr_buffer buffer) {
buffer[0].height = Int_val(Field(v, i++));
buffer[0].stride = Int_val(Field(v, i++));
ba = Caml_ba_array_val(Field(v, i++));
if (ba->dim[0] != buffer[0].stride * buffer[0].height)
if (ba->dim[0] < buffer[0].stride * buffer[0].height)
caml_raise_constant(*caml_named_value("theora_exn_inval"));
buffer[0].data = (unsigned char *)ba->data;

Expand All @@ -231,7 +231,7 @@ static void yuv_of_val(value v, th_ycbcr_buffer buffer) {
buffer[1].height = Int_val(Field(v, i++));
buffer[1].stride = Int_val(Field(v, i++));
ba = Caml_ba_array_val(Field(v, i++));
if (ba->dim[0] != buffer[1].stride * buffer[1].height)
if (ba->dim[0] < buffer[1].stride * buffer[1].height)
caml_raise_constant(*caml_named_value("theora_exn_inval"));
buffer[1].data = (unsigned char *)ba->data;

Expand All @@ -240,7 +240,7 @@ static void yuv_of_val(value v, th_ycbcr_buffer buffer) {
buffer[2].height = Int_val(Field(v, i++));
buffer[2].stride = Int_val(Field(v, i++));
ba = Caml_ba_array_val(Field(v, i++));
if (ba->dim[0] != buffer[2].stride * buffer[2].height)
if (ba->dim[0] < buffer[2].stride * buffer[2].height)
caml_raise_constant(*caml_named_value("theora_exn_inval"));
buffer[2].data = (unsigned char *)ba->data;

Expand Down

0 comments on commit 9b37004

Please sign in to comment.