}
}
-// len == 0 is not allowed
static int read_is_valid(const uint8_t *start, size_t len, const uint8_t *end) {
- return start + len > start && start + len <= end;
+ return len != 0 && len <= end - start;
}
static int decode_unsigned_max(struct vp9_read_bit_buffer *rb, int max) {
if (!is_last) {
if (!read_is_valid(*data, 4, data_end))
vpx_internal_error(error_info, VPX_CODEC_CORRUPT_FRAME,
- "Truncated packet or corrupt tile length");
+ "Truncated packet or corrupt tile length");
size = read_be32(*data);
*data += 4;
+
+ if (size > data_end - *data)
+ vpx_internal_error(error_info, VPX_CODEC_CORRUPT_FRAME,
+ "Truncated packet or corrupt tile size");
} else {
size = data_end - *data;
}