[FFmpeg-devel] [PATCH] avcodec/parser: Check next against buffer index

[Michael Niedermayer]

Fixes: out of array access
Fixes: crash-0d640731c7da52415670eb47a2af701cbe2e1a3b

Found-by: Catena cyber <contact at catenacyber.fr>
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
---
 libavcodec/parser.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/libavcodec/parser.c b/libavcodec/parser.c
index efc28b8918..db39e698ab 100644
--- a/libavcodec/parser.c
+++ b/libavcodec/parser.c
@@ -214,7 +214,7 @@ int ff_combine_frame(ParseContext *pc, int next,
     for (; pc->overread > 0; pc->overread--)
         pc->buffer[pc->index++] = pc->buffer[pc->overread_index++];
 
-    if (next > *buf_size)
+    if (next > *buf_size || (next < -pc->index && next != END_NOT_FOUND))
         return AVERROR(EINVAL);
 
     /* flush remaining if EOF */
-- 
2.17.1