generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix potential overreads in rv34 decoder.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-09-17 16:56:30 +02:00 committed by Michael Niedermayer
parent bfadca1faf
commit 9a0a64cb26
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/rv34.c
View File

@ -1483,6 +1483,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = (*buf++) + 1; slice_count = (*buf++) + 1;
slices_hdr = buf + 4; slices_hdr = buf + 4;
buf += 8 * slice_count; buf += 8 * slice_count;
buf_size -= 1 + 8 * slice_count;
}else }else
slice_count = avctx->slice_count; slice_count = avctx->slice_count;
@ -1501,7 +1502,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B) if( (avctx->skip_frame >= AVDISCARD_NONREF && si.type==AV_PICTURE_TYPE_B)
|| (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I) || (avctx->skip_frame >= AVDISCARD_NONKEY && si.type!=AV_PICTURE_TYPE_I)
|| avctx->skip_frame >= AVDISCARD_ALL) || avctx->skip_frame >= AVDISCARD_ALL)
return buf_size; return avpkt->size;
for(i = 0; i < slice_count; i++){ for(i = 0; i < slice_count; i++){
int offset = get_slice_offset(avctx, slices_hdr, i); int offset = get_slice_offset(avctx, slices_hdr, i);
@ -1550,7 +1551,7 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
} }
s->current_picture_ptr = NULL; //so we can detect if frame_end wasnt called (find some nicer solution...) s->current_picture_ptr = NULL; //so we can detect if frame_end wasnt called (find some nicer solution...)
} }
return buf_size; return avpkt->size;
} }
av_cold int ff_rv34_decode_end(AVCodecContext *avctx) av_cold int ff_rv34_decode_end(AVCodecContext *avctx)