RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-23 07:16:56 +00:00
Code Issues Projects Releases Wiki Activity

indeo4/5: check empty tile size in decode_mb_info().

Browse Source 
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2012-2800

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ae3da0ae55)

Conflicts:

	libavcodec/ivi_common.c
This commit is contained in:
Anton Khirnov 2012-09-29 11:07:58 +02:00 committed by Reinhard Tartler
parent 604d72aa0d
commit 440e98574b
3 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/indeo5.c
View File

@ -619,8 +619,10 @@ static int decode_band(IVI5DecContext *ctx, int plane_num,
tile->is_empty = get_bits1(&ctx->gb);
if (tile->is_empty) {
ff_ivi_process_empty_tile(avctx, band, tile,
result = ff_ivi_process_empty_tile(avctx, band, tile,
(ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
if (result < 0)
break;
} else {
tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);

11
libavcodec/ivi_common.c
View File

@ -495,7 +495,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
return 0;
}
void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
IVITile *tile, int32_t mv_scale)
{
int x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type;
@ -506,6 +506,13 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
int mc_type);
if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches "
"parameters %d in ivi_process_empty_tile()\n",
tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
return AVERROR_INVALIDDATA;
}
offs = tile->ypos * band->pitch + tile->xpos;
mb = tile->mbs;
ref_mb = tile->ref_mbs;
@ -586,6 +593,8 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
dst += band->pitch;
}
}
return 0;
}

2
libavcodec/ivi_common.h
View File

@ -325,7 +325,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile);
* @param[in] tile pointer to the tile descriptor
* @param[in] mv_scale scaling factor for motion vectors
*/
void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
IVITile *tile, int32_t mv_scale);
/**