RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-11 09:35:22 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/rscc: Check input size for raw mode

Browse Source 
Fixes out of array read
Fixes: 7fcd09eadd046e326d8ea0af66f166c8/asan_heap-oob_4a52e5_2273_fa6078a10dd575df266fb1e0b4114cd5.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-11-14 17:59:56 +01:00
parent 618b3ae7d4
commit ac6ab77741
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/rscc.c
View File

@ -221,6 +221,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data,
/* Get pixels buffer, it may be deflated or just raw */
if (pixel_size == packed_size) {
if (bytestream2_get_bytes_left(gbc) < pixel_size) {
av_log(avctx, AV_LOG_ERROR, "Insufficient input for %d\n", pixel_size);
ret = AVERROR_INVALIDDATA;
goto end;
}
pixels = gbc->buffer;
} else {
uLongf len = ctx->inflated_size;