generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

8bps: Bound-check the input buffer

Browse Source 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit bd7b4da0f4)

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/8bps.c
This commit is contained in:
Luca Barbato
2013-07-22 23:26:05 +02:00
parent f8602ef717
commit e6cf47ee9e
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/8bps.c
View File

@@ -64,7 +64,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
unsigned char *pixptr, *pixptr_end; unsigned char *pixptr, *pixptr_end;
unsigned int height = avctx->height; // Real image height unsigned int height = avctx->height; // Real image height
unsigned int dlen, p, row; unsigned int dlen, p, row;
const unsigned char *lp, *dp; const unsigned char *lp, *dp, *ep;
unsigned char count; unsigned char count;
unsigned int px_inc; unsigned int px_inc;
unsigned int planes = c->planes; unsigned int planes = c->planes;
@@ -80,6 +80,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
return -1; return -1;
} }
ep = encoded + buf_size;
/* Set data pointer after line lengths */ /* Set data pointer after line lengths */
dp = encoded + planes * (height << 1); dp = encoded + planes * (height << 1);
@@ -97,17 +99,19 @@ static int decode_frame(AVCodecContext *avctx, void *data,
for (row = 0; row < height; row++) { for (row = 0; row < height; row++) {
pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p];
pixptr_end = pixptr + c->pic.linesize[0]; pixptr_end = pixptr + c->pic.linesize[0];
if (ep - lp < row * 2 + 2)
return AVERROR_INVALIDDATA;
dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2)); dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));
/* Decode a row of this plane */ /* Decode a row of this plane */
while (dlen > 0) { while (dlen > 0) {
if (dp + 1 >= buf + buf_size) if (ep - dp <= 1)
return -1; return -1;
if ((count = *dp++) <= 127) { if ((count = *dp++) <= 127) {
count++; count++;
dlen -= count + 1; dlen -= count + 1;
if (pixptr + count * px_inc > pixptr_end) if (pixptr + count * px_inc > pixptr_end)
break; break;
if (dp + count > buf + buf_size) if (ep - dp < count)
return -1; return -1;
while (count--) { while (count--) {
*pixptr = *dp++; *pixptr = *dp++;