generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/vc1: Check bfraction_lut_index

Browse Source 
Fixes: out of array read
Fixes: asan_static-oob_1b40507_2849_SA10143.vc1
Fixes: asan_static-oob_1b40a15_2849_cov_1182297305_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_2159513432_SA10143.vc1
Fixes: asan_static-oob_1b40f15_2849_cov_3230311510_SA10143.vc1
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-02-01 17:07:40 +01:00
parent 388b4cf86e
commit dcf5bfbdb6
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/vc1.c
View File

@ -614,7 +614,13 @@ static void rotate_luts(VC1Context *v)
} }
static int read_bfraction(VC1Context *v, GetBitContext* gb) { static int read_bfraction(VC1Context *v, GetBitContext* gb) {
v->bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1); int bfraction_lut_index = get_vlc2(gb, ff_vc1_bfraction_vlc.table, VC1_BFRACTION_VLC_BITS, 1);
if (bfraction_lut_index == 21 || bfraction_lut_index < 0) {
av_log(v->s.avctx, AV_LOG_ERROR, "bfraction invalid\n");
return AVERROR_INVALIDDATA;
}
v->bfraction_lut_index = bfraction_lut_index;
v->bfraction = ff_vc1_bfraction_lut[v->bfraction_lut_index]; v->bfraction = ff_vc1_bfraction_lut[v->bfraction_lut_index];
return 0; return 0;
} }