generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

svq1: do not modify the input packet

Browse Source 
The input data must remain constant, make a copy instead. This is in
theory a performance hit, but since I failed to find any samples
using this feature, this should not matter in practice.

Also, check the size of the header, avoiding invalid reads on truncated
data.

CC:libav-stable@libav.org
(cherry picked from commit 7b588bb691)
Signed-off-by: Anton Khirnov <anton@khirnov.net>

Conflicts:
	libavcodec/svq1dec.c
This commit is contained in:
Anton Khirnov
2014-08-03 10:14:48 +02:00
parent 80c268eaae
commit af9b62654d
1 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/svq1dec.c
View File

@@ -61,6 +61,10 @@ typedef struct SVQ1Context {
DSPContext dsp; DSPContext dsp;
GetBitContext gb; GetBitContext gb;
AVFrame *cur, *prev; AVFrame *cur, *prev;
uint8_t *pkt_swapped;
int pkt_swapped_allocated;
int width; int width;
int height; int height;
int frame_code; int frame_code;
@@ -630,7 +634,24 @@ static int svq1_decode_frame(AVCodecContext *avctx, void *data,
/* swap some header bytes (why?) */ /* swap some header bytes (why?) */
if (s->frame_code != 0x20) { if (s->frame_code != 0x20) {
uint32_t *src = (uint32_t *)(buf + 4); uint32_t *src;
if (buf_size < 9 * 4) {
av_log(avctx, AV_LOG_ERROR, "Input packet too small\n");
return AVERROR_INVALIDDATA;
}
av_fast_malloc(s->pkt_swapped, &s->pkt_swapped_allocated,
buf_size);
if (!s->pkt_swapped)
return AVERROR(ENOMEM);
memcpy(s->pkt_swapped, buf, buf_size);
buf = s->pkt_swapped;
init_get_bits(&s->gb, buf, buf_size * 8);
skip_bits(&s->gb, 22);
src = (uint32_t *)(s->pkt_swapped + 4);
for (i = 0; i < 4; i++) for (i = 0; i < 4; i++)
src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i]; src[i] = ((src[i] << 16) | (src[i] >> 16)) ^ src[7 - i];
@@ -803,6 +824,7 @@ static av_cold int svq1_decode_end(AVCodecContext *avctx)
avctx->release_buffer(avctx, s->prev); avctx->release_buffer(avctx, s->prev);
avcodec_free_frame(&s->cur); avcodec_free_frame(&s->cur);
avcodec_free_frame(&s->prev); avcodec_free_frame(&s->prev);
av_freep(&s->pkt_swapped);
return 0; return 0;
} }