RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

indeo4/5: check empty tile size in decode_mb_info(). 

This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Based on a patch by Michael Niedermayer <michaelni@gmx.at>

Fixes CVE-2012-2800

CC:libav-stable@libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
This commit is contained in:
Anton Khirnov 2012-09-29 11:07:58 +02:00
parent 5d2170c53b
commit ae3da0ae55
1 changed files with 14 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/ivi_common.c
View File

@ -498,7 +498,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
* @param[in] tile pointer to the tile descriptor * @param[in] tile pointer to the tile descriptor
* @param[in] mv_scale scaling factor for motion vectors * @param[in] mv_scale scaling factor for motion vectors
*/ */
static void ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, static int ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
IVITile *tile, int32_t mv_scale) IVITile *tile, int32_t mv_scale)
{ {
int x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type; int x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type;
@ -509,6 +509,13 @@ static void ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch, void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
int mc_type); int mc_type);
if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches "
"parameters %d in ivi_process_empty_tile()\n",
tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
return AVERROR_INVALIDDATA;
}
offs = tile->ypos * band->pitch + tile->xpos; offs = tile->ypos * band->pitch + tile->xpos;
mb = tile->mbs; mb = tile->mbs;
ref_mb = tile->ref_mbs; ref_mb = tile->ref_mbs;
@ -589,6 +596,8 @@ static void ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
dst += band->pitch; dst += band->pitch;
} }
} }
return 0;
} }
@ -682,8 +691,10 @@ static int decode_band(IVI45DecContext *ctx, int plane_num,
} }
tile->is_empty = get_bits1(&ctx->gb); tile->is_empty = get_bits1(&ctx->gb);
if (tile->is_empty) { if (tile->is_empty) {
ivi_process_empty_tile(avctx, band, tile, result = ivi_process_empty_tile(avctx, band, tile,
(ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3)); (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
if (result < 0)
break;
av_dlog(avctx, "Empty tile encountered!\n"); av_dlog(avctx, "Empty tile encountered!\n");
} else { } else {
tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb); tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);