generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

indeo5: check tile size in decode_mb_info().

Browse Source 
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Fixes CVE-2012-2794

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2d09cdbaf2)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Michael Niedermayer
2012-04-15 14:11:50 +02:00
committed by Reinhard Tartler
parent 8148833193
commit aa097b4d5f
1 changed files with 6 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/indeo5.c
View File

@@ -457,6 +457,12 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv)) ((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches parameters %d\n",
tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
return AVERROR_INVALIDDATA;
}
/* scale factor for motion vectors */ /* scale factor for motion vectors */
mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
mv_x = mv_y = 0; mv_x = mv_y = 0;