generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

huffyuvdec: Check init_vlc() return codes.

Browse Source 
Prevents out of array writes

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc)

Conflicts:

	libavcodec/huffyuv.c
(cherry picked from commit 277def59fce10d91e3113e5c0f63e22bc4abfa88)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-01-29 18:29:41 +01:00
parent ef953f760e
commit ba4b57e802
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/huffyuv.c
View File

@ -28,6 +28,7 @@
* huffyuv codec for libavcodec. * huffyuv codec for libavcodec.
*/ */
#include "libavutil/avassert.h"
#include "avcodec.h" #include "avcodec.h"
#include "get_bits.h" #include "get_bits.h"
#include "put_bits.h" #include "put_bits.h"
@ -317,6 +318,7 @@ static void generate_joint_tables(HYuvContext *s){
int len1 = s->len[p][u]; int len1 = s->len[p][u];
if(len1 > limit) if(len1 > limit)
continue; continue;
av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1; len[i] = len0 + len1;
bits[i] = (s->bits[0][y] << len1) + s->bits[p][u]; bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
symbols[i] = (y<<8) + u; symbols[i] = (y<<8) + u;
@ -350,6 +352,7 @@ static void generate_joint_tables(HYuvContext *s){
int len2 = s->len[2][r&255]; int len2 = s->len[2][r&255];
if(len2 > limit1) if(len2 > limit1)
continue; continue;
av_assert0(i < (1 << VLC_BITS));
len[i] = len0 + len1 + len2; len[i] = len0 + len1 + len2;
bits[i] = (code << len2) + s->bits[2][r&255]; bits[i] = (code << len2) + s->bits[2][r&255];
if(s->decorrelate){ if(s->decorrelate){
@ -373,6 +376,7 @@ static void generate_joint_tables(HYuvContext *s){
static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
GetBitContext gb; GetBitContext gb;
int i; int i;
int ret;
init_get_bits(&gb, src, length*8); init_get_bits(&gb, src, length*8);
@ -383,7 +387,8 @@ static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
return -1; return -1;
} }
ff_free_vlc(&s->vlc[i]); ff_free_vlc(&s->vlc[i]);
init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
return ret;
} }
generate_joint_tables(s); generate_joint_tables(s);
@ -395,6 +400,7 @@ static int read_old_huffman_tables(HYuvContext *s){
#if 1 #if 1
GetBitContext gb; GetBitContext gb;
int i; int i;
int ret;
init_get_bits(&gb, classic_shift_luma, classic_shift_luma_table_size*8); init_get_bits(&gb, classic_shift_luma, classic_shift_luma_table_size*8);
if(read_len_table(s->len[0], &gb)<0) if(read_len_table(s->len[0], &gb)<0)
@ -415,7 +421,8 @@ static int read_old_huffman_tables(HYuvContext *s){
for(i=0; i<3; i++){ for(i=0; i<3; i++){
ff_free_vlc(&s->vlc[i]); ff_free_vlc(&s->vlc[i]);
init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
return ret;
} }
generate_joint_tables(s); generate_joint_tables(s);