RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/cfhd: Increase minimum band dimension to 3 

The implementation does not currently support len=2

Fixes out of array accesses
Fixes: 29d1b3db5ba2205e82b0b3a533e057a3/asan_heap-oob_12b650c_9254_3b8c4e4d931eb2c32841c18ebb297f1d.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-08-19 21:34:38 +02:00
parent 0d8b6a15dd
commit b8b3671721
1 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/cfhd.c
View File

@ -320,7 +320,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
s->plane[s->channel_num].band[0][0].width = data; s->plane[s->channel_num].band[0][0].width = data;
s->plane[s->channel_num].band[0][0].stride = data; s->plane[s->channel_num].band[0][0].stride = data;
av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data); av_log(avctx, AV_LOG_DEBUG, "Lowpass width %"PRIu16"\n", data);
if (data < 2 || data > s->plane[s->channel_num].band[0][0].a_width) { if (data < 3 || data > s->plane[s->channel_num].band[0][0].a_width) {
av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n"); av_log(avctx, AV_LOG_ERROR, "Invalid lowpass width\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;
@ -328,7 +328,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
} else if (tag == 28) { } else if (tag == 28) {
s->plane[s->channel_num].band[0][0].height = data; s->plane[s->channel_num].band[0][0].height = data;
av_log(avctx, AV_LOG_DEBUG, "Lowpass height %"PRIu16"\n", data); av_log(avctx, AV_LOG_DEBUG, "Lowpass height %"PRIu16"\n", data);
if (data < 2 || data > s->plane[s->channel_num].band[0][0].height) { if (data < 3 || data > s->plane[s->channel_num].band[0][0].height) {
av_log(avctx, AV_LOG_ERROR, "Invalid lowpass height\n"); av_log(avctx, AV_LOG_ERROR, "Invalid lowpass height\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;
@ -366,7 +366,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
s->plane[s->channel_num].band[s->level][s->subband_num].width = data; s->plane[s->channel_num].band[s->level][s->subband_num].width = data;
s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8); s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i subband %i\n", data, s->channel_num, s->level, s->subband_num); av_log(avctx, AV_LOG_DEBUG, "Highpass width %i channel %i level %i subband %i\n", data, s->channel_num, s->level, s->subband_num);
if (data < 2) { if (data < 3) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n"); av_log(avctx, AV_LOG_ERROR, "Invalid highpass width\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;
@ -374,7 +374,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
} else if (tag == 42) { } else if (tag == 42) {
s->plane[s->channel_num].band[s->level][s->subband_num].height = data; s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
av_log(avctx, AV_LOG_DEBUG, "Highpass height %i\n", data); av_log(avctx, AV_LOG_DEBUG, "Highpass height %i\n", data);
if (data < 2) { if (data < 3) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass height\n"); av_log(avctx, AV_LOG_ERROR, "Invalid highpass height\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;
@ -383,7 +383,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
s->plane[s->channel_num].band[s->level][s->subband_num].width = data; s->plane[s->channel_num].band[s->level][s->subband_num].width = data;
s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8); s->plane[s->channel_num].band[s->level][s->subband_num].stride = FFALIGN(data, 8);
av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data); av_log(avctx, AV_LOG_DEBUG, "Highpass width2 %i\n", data);
if (data < 2) { if (data < 3) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n"); av_log(avctx, AV_LOG_ERROR, "Invalid highpass width2\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;
@ -391,7 +391,7 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame,
} else if (tag == 50) { } else if (tag == 50) {
s->plane[s->channel_num].band[s->level][s->subband_num].height = data; s->plane[s->channel_num].band[s->level][s->subband_num].height = data;
av_log(avctx, AV_LOG_DEBUG, "Highpass height2 %i\n", data); av_log(avctx, AV_LOG_DEBUG, "Highpass height2 %i\n", data);
if (data < 2) { if (data < 3) {
av_log(avctx, AV_LOG_ERROR, "Invalid highpass height2\n"); av_log(avctx, AV_LOG_ERROR, "Invalid highpass height2\n");
ret = AVERROR(EINVAL); ret = AVERROR(EINVAL);
break; break;