generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

pcx: Do not overread source buffer in pcx_rle_decode

Browse Source 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 3abde1a3b4)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Luca Barbato
2013-06-29 06:37:32 +02:00
parent d6a65735f9
commit 64867f3cb5
1 changed files with 18 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
libavcodec/pcx.c
View File

@@ -44,16 +44,19 @@ static av_cold int pcx_init(AVCodecContext *avctx) {
/** /**
* @return advanced src pointer * @return advanced src pointer
*/ */
static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, static const uint8_t *pcx_rle_decode(const uint8_t *src,
unsigned int bytes_per_scanline, int compressed) { const uint8_t *end,
uint8_t *dst,
unsigned int bytes_per_scanline,
int compressed) {
unsigned int i = 0; unsigned int i = 0;
unsigned char run, value; unsigned char run, value;
if (compressed) { if (compressed) {
while (i<bytes_per_scanline) { while (i < bytes_per_scanline && src < end) {
run = 1; run = 1;
value = *src++; value = *src++;
if (value >= 0xc0) { if (value >= 0xc0 && src < end) {
run = value & 0x3f; run = value & 0x3f;
value = *src++; value = *src++;
} }
@@ -88,6 +91,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x, unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x,
bytes_per_scanline; bytes_per_scanline;
uint8_t *ptr; uint8_t *ptr;
const uint8_t *buf_end = buf + buf_size;
uint8_t const *bufstart = buf; uint8_t const *bufstart = buf;
uint8_t *scanline; uint8_t *scanline;
int ret = -1; int ret = -1;
@@ -116,7 +120,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
nplanes = buf[65]; nplanes = buf[65];
bytes_per_scanline = nplanes * bytes_per_line; bytes_per_scanline = nplanes * bytes_per_line;
if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) { if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 ||
(!compressed && bytes_per_scanline > buf_size / h)) {
av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n"); av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
return -1; return -1;
} }
@@ -164,7 +169,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
if (nplanes == 3 && bits_per_pixel == 8) { if (nplanes == 3 && bits_per_pixel == 8) {
for (y=0; y<h; y++) { for (y=0; y<h; y++) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x=0; x<w; x++) { for (x=0; x<w; x++) {
ptr[3*x ] = scanline[x ]; ptr[3*x ] = scanline[x ];
@@ -179,7 +185,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
const uint8_t *palstart = bufstart + buf_size - 769; const uint8_t *palstart = bufstart + buf_size - 769;
for (y=0; y<h; y++, ptr+=stride) { for (y=0; y<h; y++, ptr+=stride) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
memcpy(ptr, scanline, w); memcpy(ptr, scanline, w);
} }
@@ -198,7 +205,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
for (y=0; y<h; y++) { for (y=0; y<h; y++) {
init_get_bits(&s, scanline, bytes_per_scanline<<3); init_get_bits(&s, scanline, bytes_per_scanline<<3);
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x=0; x<w; x++) for (x=0; x<w; x++)
ptr[x] = get_bits(&s, bits_per_pixel); ptr[x] = get_bits(&s, bits_per_pixel);
@@ -209,7 +217,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
int i; int i;
for (y=0; y<h; y++) { for (y=0; y<h; y++) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x=0; x<w; x++) { for (x=0; x<w; x++) {
int m = 0x80 >> (x&7), v = 0; int m = 0x80 >> (x&7), v = 0;