generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

indeo3: Fix out of reference reading with NULL blocks.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-03-10 21:12:41 +01:00
parent 6fe8cb7d70
commit 50f4f272fe
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/indeo3.c
View File

@ -729,6 +729,7 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
{
Cell curr_cell;
int bytes_used;
int mv_x, mv_y;
if (depth <= 0) {
av_log(avctx, AV_LOG_ERROR, "Stack overflow (corrupted binary tree)!\n");
@ -779,6 +780,17 @@ static int parse_bintree(Indeo3DecodeContext *ctx, AVCodecContext *avctx,
CHECK_CELL
if (!curr_cell.mv_ptr)
return AVERROR_INVALIDDATA;
mv_y = curr_cell.mv_ptr[0];
mv_x = curr_cell.mv_ptr[1];
if ( mv_x + 4*curr_cell.xpos < 0
|| mv_y + 4*curr_cell.ypos < 0
|| mv_x + 4*curr_cell.xpos + 4*curr_cell.width > plane->width
|| mv_y + 4*curr_cell.ypos + 4*curr_cell.height > plane->height) {
av_log(avctx, AV_LOG_ERROR, "motion vector %d %d outside reference\n", mv_x + 4*curr_cell.xpos, mv_y + 4*curr_cell.ypos);
return AVERROR_INVALIDDATA;
}
copy_cell(ctx, plane, &curr_cell);
return 0;
}