RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-26 00:31:12 +00:00
Code Issues Projects Releases Wiki Activity

gifdec: refactor interleave end handling

Browse Source 
Fixes invalid writes with very small image heights.

CC: libav-stable@libav.org
Bug-ID: CVE-2014-8547
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0b39ac6f54)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eac49477aa)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Michael Niedermayer 2014-10-03 20:15:52 +02:00 committed by Anton Khirnov
parent 3f10a779b4
commit 92888e9ed4
1 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/gifdec.c
View File

@ -125,26 +125,21 @@ static int gif_read_image(GifState *s, AVFrame *frame)
case 1: case 1:
y1 += 8; y1 += 8;
ptr += linesize * 8; ptr += linesize * 8;
if (y1 >= height) {
y1 = pass ? 2 : 4;
ptr = ptr1 + linesize * y1;
pass++;
}
break; break;
case 2: case 2:
y1 += 4; y1 += 4;
ptr += linesize * 4; ptr += linesize * 4;
if (y1 >= height) {
y1 = 1;
ptr = ptr1 + linesize;
pass++;
}
break; break;
case 3: case 3:
y1 += 2; y1 += 2;
ptr += linesize * 2; ptr += linesize * 2;
break; break;
} }
while (y1 >= height) {
y1 = 4 >> pass;
ptr = ptr1 + linesize * y1;
pass++;
}
} else { } else {
ptr += linesize; ptr += linesize;
} }