RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-14 11:21:29 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/xpmdec: do not allow number of colors to be higher than allocated

Browse Source 
Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2017-03-12 22:51:00 +01:00
parent fbc1f323db
commit 2b790b1c9e
1 changed files with 9 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/xpmdec.c
View File

@ -328,29 +328,22 @@ static int xpm_decode_frame(AVCodecContext *avctx, void *data,
if ((ret = ff_get_buffer(avctx, p, 0)) < 0) if ((ret = ff_get_buffer(avctx, p, 0)) < 0)
return ret; return ret;
if (ncolors <= 0) { if (cpp <= 0 || cpp >= 5) {
av_log(avctx, AV_LOG_ERROR, "invalid number of colors: %d\n", ncolors); av_log(avctx, AV_LOG_ERROR, "unsupported/invalid number of chars per pixel: %d\n", cpp);
return AVERROR_INVALIDDATA;
}
if (cpp <= 0) {
av_log(avctx, AV_LOG_ERROR, "invalid number of chars per pixel: %d\n", cpp);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
size = 1; size = 1;
j = 1; for (i = 0; i < cpp; i++)
for (i = 0; i < cpp; i++) { size *= 94;
size += j * 94;
j *= 95;
}
size *= 4;
if (size < 0) { if (ncolors <= 0 || ncolors > size) {
av_log(avctx, AV_LOG_ERROR, "unsupported number of chars per pixel: %d\n", cpp); av_log(avctx, AV_LOG_ERROR, "invalid number of colors: %d\n", ncolors);
return AVERROR(ENOMEM); return AVERROR_INVALIDDATA;
} }
size *= 4;
av_fast_padded_malloc(&x->pixels, &x->pixels_size, size); av_fast_padded_malloc(&x->pixels, &x->pixels_size, size);
if (!x->pixels) if (!x->pixels)
return AVERROR(ENOMEM); return AVERROR(ENOMEM);