RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mss2: Fix buffer overflow. 

Reported as https://trac.mplayerhq.hu/ticket/2264 but have
not been able to reproduce with FFmpeg-only.
I have no idea what coded_height is used for here exactly,
so this might not be the best fix.
Fixes the following chain of events:
ff_mss12_decode_init sets coded_height while not setting height.
ff_mpv_decode_init then copies coded_height into MpegEncContext height.
This is then used by init_context_frame to allocate the data structures.
However the wmv9rects are validated/initialized based on avctx->height, not
avctx->coded_height.
Thus the decode_wmv9 function will try to decode a larger video that we
allocated data structures for, causing out-of-bounds writes.

Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
This commit is contained in:
Reimar Döffinger 2016-02-25 21:04:36 +01:00
parent 5d18dc3795
commit 0f199f0ad0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/mss12.c
View File

@ -581,8 +581,8 @@ av_cold int ff_mss12_decode_init(MSS12Context *c, int version,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
avctx->coded_width = AV_RB32(avctx->extradata + 20); avctx->coded_width = FFMAX(AV_RB32(avctx->extradata + 20), avctx->width);
avctx->coded_height = AV_RB32(avctx->extradata + 24); avctx->coded_height = FFMAX(AV_RB32(avctx->extradata + 24), avctx->height);
if (avctx->coded_width > 4096 || avctx->coded_height > 4096) { if (avctx->coded_width > 4096 || avctx->coded_height > 4096) {
av_log(avctx, AV_LOG_ERROR, "Frame dimensions %dx%d too large", av_log(avctx, AV_LOG_ERROR, "Frame dimensions %dx%d too large",
avctx->coded_width, avctx->coded_height); avctx->coded_width, avctx->coded_height);