RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

gifdec: refactor interleave end handling 

Fixes invalid writes with very small image heights.

CC: libav-stable@libav.org
Bug-ID: CVE-2014-8547
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 0b39ac6f54)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit eac49477aa)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 92888e9ed4)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 02de44073a)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Michael Niedermayer 2014-10-03 20:15:52 +02:00 committed by Anton Khirnov
parent a331e11906
commit 9ae3cd6e72
1 changed files with 5 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/gifdec.c
View File

@ -125,26 +125,21 @@ static int gif_read_image(GifState *s)
case 1:
y1 += 8;
ptr += linesize * 8;
if (y1 >= height) {
y1 = pass ? 2 : 4;
ptr = ptr1 + linesize * y1;
pass++;
}
break;
case 2:
y1 += 4;
ptr += linesize * 4;
if (y1 >= height) {
y1 = 1;
ptr = ptr1 + linesize;
pass++;
}
break;
case 3:
y1 += 2;
ptr += linesize * 2;
break;
}
while (y1 >= height) {
y1 = 4 >> pass;
ptr = ptr1 + linesize * y1;
pass++;
}
} else {
ptr += linesize;
}