RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

bfi: Use bytestream2 functions to prevent buffer overreads. 

Signed-off-by: Ronald S. Bultje <rsbultje@gmail.com>
This commit is contained in:
Aneesh Dogra 2012-01-09 01:27:58 +05:30 committed by Ronald S. Bultje
parent 529a25d6e5
commit ccc27e2139
1 changed files with 14 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
libavcodec/bfi.c
View File

@ -47,7 +47,7 @@ static av_cold int bfi_decode_init(AVCodecContext *avctx)
static int bfi_decode_frame(AVCodecContext *avctx, void *data, static int bfi_decode_frame(AVCodecContext *avctx, void *data,
int *data_size, AVPacket *avpkt) int *data_size, AVPacket *avpkt)
{ {
const uint8_t *buf = avpkt->data, *buf_end = avpkt->data + avpkt->size; GetByteContext g;
int buf_size = avpkt->size; int buf_size = avpkt->size;
BFIContext *bfi = avctx->priv_data; BFIContext *bfi = avctx->priv_data;
uint8_t *dst = bfi->dst; uint8_t *dst = bfi->dst;
@ -66,6 +66,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data,
return -1; return -1;
} }
bytestream2_init(&g, avpkt->data, buf_size);
/* Set frame parameters and palette, if necessary */ /* Set frame parameters and palette, if necessary */
if (!avctx->frame_number) { if (!avctx->frame_number) {
bfi->frame.pict_type = AV_PICTURE_TYPE_I; bfi->frame.pict_type = AV_PICTURE_TYPE_I;
@ -91,15 +93,15 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data,
bfi->frame.key_frame = 0; bfi->frame.key_frame = 0;
} }
buf += 4; // Unpacked size, not required. bytestream2_skip(&g, 4); // Unpacked size, not required.
while (dst != frame_end) { while (dst != frame_end) {
static const uint8_t lentab[4] = { 0, 2, 0, 1 }; static const uint8_t lentab[4] = { 0, 2, 0, 1 };
unsigned int byte = *buf++, av_uninit(offset); unsigned int byte = bytestream2_get_byte(&g), av_uninit(offset);
unsigned int code = byte >> 6; unsigned int code = byte >> 6;
unsigned int length = byte & ~0xC0; unsigned int length = byte & ~0xC0;
if (buf >= buf_end) { if (!bytestream2_get_bytes_left(&g)) {
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,
"Input resolution larger than actual frame.\n"); "Input resolution larger than actual frame.\n");
return -1; return -1;
@ -108,16 +110,16 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data,
/* Get length and offset(if required) */ /* Get length and offset(if required) */
if (length == 0) { if (length == 0) {
if (code == 1) { if (code == 1) {
length = bytestream_get_byte(&buf); length = bytestream2_get_byte(&g);
offset = bytestream_get_le16(&buf); offset = bytestream2_get_le16(&g);
} else { } else {
length = bytestream_get_le16(&buf); length = bytestream2_get_le16(&g);
if (code == 2 && length == 0) if (code == 2 && length == 0)
break; break;
} }
} else { } else {
if (code == 1) if (code == 1)
offset = bytestream_get_byte(&buf); offset = bytestream2_get_byte(&g);
} }
/* Do boundary check */ /* Do boundary check */
@ -127,11 +129,11 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data,
switch (code) { switch (code) {
case 0: //Normal Chain case 0: //Normal Chain
if (length >= buf_end - buf) { if (length >= bytestream2_get_bytes_left(&g)) {
av_log(avctx, AV_LOG_ERROR, "Frame larger than buffer.\n"); av_log(avctx, AV_LOG_ERROR, "Frame larger than buffer.\n");
return -1; return -1;
} }
bytestream_get_buffer(&buf, dst, length); bytestream2_get_buffer(&g, dst, length);
dst += length; dst += length;
break; break;
@ -149,8 +151,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data,
break; break;
case 3: //Fill Chain case 3: //Fill Chain
colour1 = bytestream_get_byte(&buf); colour1 = bytestream2_get_byte(&g);
colour2 = bytestream_get_byte(&buf); colour2 = bytestream2_get_byte(&g);
while (length--) { while (length--) {
*dst++ = colour1; *dst++ = colour1;
*dst++ = colour2; *dst++ = colour2;