generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/avidec: Use a buffer with sufficient padding in read_gab2_sub()

Browse Source 
Fixes out of array read
Fixes: 0ff9841c2a102f06e0d582bfc3376cbd-asan_heap-oob_495589_6836_cov_1763916974_mewmew_ssa.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-03-02 04:15:40 +01:00
parent 73f930ee71
commit 52a2138656
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/avidec.c
View File

@ -904,12 +904,14 @@ fail:
static int read_gab2_sub(AVStream *st, AVPacket *pkt) static int read_gab2_sub(AVStream *st, AVPacket *pkt)
{ {
if (pkt->size >= 7 && if (pkt->size >= 7 &&
pkt->size < INT_MAX - AVPROBE_PADDING_SIZE &&
!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) { !strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) {
uint8_t desc[256]; uint8_t desc[256];
int score = AVPROBE_SCORE_EXTENSION, ret; int score = AVPROBE_SCORE_EXTENSION, ret;
AVIStream *ast = st->priv_data; AVIStream *ast = st->priv_data;
AVInputFormat *sub_demuxer; AVInputFormat *sub_demuxer;
AVRational time_base; AVRational time_base;
int size;
AVIOContext *pb = avio_alloc_context(pkt->data + 7, AVIOContext *pb = avio_alloc_context(pkt->data + 7,
pkt->size - 7, pkt->size - 7,
0, NULL, NULL, NULL, NULL); 0, NULL, NULL, NULL, NULL);
@ -927,9 +929,15 @@ static int read_gab2_sub(AVStream *st, AVPacket *pkt)
avio_rl16(pb); /* flags? */ avio_rl16(pb); /* flags? */
avio_rl32(pb); /* data size */ avio_rl32(pb); /* data size */
pd = (AVProbeData) { .buf = pb->buf_ptr, size = pb->buf_end - pb->buf_ptr;
.buf_size = pb->buf_end - pb->buf_ptr }; pd = (AVProbeData) { .buf = av_mallocz(size + AVPROBE_PADDING_SIZE),
if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score))) .buf_size = size };
if (!pd.buf)
goto error;
memcpy(pd.buf, pb->buf_ptr, size);
sub_demuxer = av_probe_input_format2(&pd, 1, &score);
av_freep(&pd.buf);
if (!sub_demuxer)
goto error; goto error;
if (!(ast->sub_ctx = avformat_alloc_context())) if (!(ast->sub_ctx = avformat_alloc_context()))