generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

nsvdec: Be more careful with av_malloc().

Browse Source 
Check results for av_malloc() and fix an overflow in one call.

Related to CVE-2011-3940.

Based in part on work from Michael Niedermayer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
This commit is contained in:
Alex Converse 2012-01-26 17:21:46 -08:00
parent 6a89b41d97
commit 8fd8a48263
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavformat/nsvdec.c
View File

@ -314,7 +314,9 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
char *token, *value; char *token, *value;
char quote; char quote;
p = strings = av_mallocz(strings_size + 1); p = strings = av_mallocz((size_t)strings_size + 1);
if (!p)
return AVERROR(ENOMEM);
endp = strings + strings_size; endp = strings + strings_size;
avio_read(pb, strings, strings_size); avio_read(pb, strings, strings_size);
while (p < endp) { while (p < endp) {
@ -349,6 +351,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
if((unsigned)table_entries_used >= UINT_MAX / sizeof(uint32_t)) if((unsigned)table_entries_used >= UINT_MAX / sizeof(uint32_t))
return -1; return -1;
nsv->nsvs_file_offset = av_malloc((unsigned)table_entries_used * sizeof(uint32_t)); nsv->nsvs_file_offset = av_malloc((unsigned)table_entries_used * sizeof(uint32_t));
if (!nsv->nsvs_file_offset)
return AVERROR(ENOMEM);
for(i=0;i<table_entries_used;i++) for(i=0;i<table_entries_used;i++)
nsv->nsvs_file_offset[i] = avio_rl32(pb) + size; nsv->nsvs_file_offset[i] = avio_rl32(pb) + size;
@ -356,6 +360,8 @@ static int nsv_parse_NSVf_header(AVFormatContext *s)
if(table_entries > table_entries_used && if(table_entries > table_entries_used &&
avio_rl32(pb) == MKTAG('T','O','C','2')) { avio_rl32(pb) == MKTAG('T','O','C','2')) {
nsv->nsvs_timestamps = av_malloc((unsigned)table_entries_used*sizeof(uint32_t)); nsv->nsvs_timestamps = av_malloc((unsigned)table_entries_used*sizeof(uint32_t));
if (!nsv->nsvs_timestamps)
return AVERROR(ENOMEM);
for(i=0;i<table_entries_used;i++) { for(i=0;i<table_entries_used;i++) {
nsv->nsvs_timestamps[i] = avio_rl32(pb); nsv->nsvs_timestamps[i] = avio_rl32(pb);
} }