RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2024-12-18 05:24:42 +00:00
Code Issues Projects Releases Wiki Activity

8bps: Bound-check the input buffer

Browse Source 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-07-22 23:26:05 +02:00
parent 2f034f255c
commit bd7b4da0f4
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/8bps.c
View File

@ -64,7 +64,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
unsigned char *pixptr, *pixptr_end;
unsigned int height = avctx->height; // Real image height
unsigned int dlen, p, row;
const unsigned char *lp, *dp;
const unsigned char *lp, *dp, *ep;
unsigned char count;
unsigned int px_inc;
unsigned int planes = c->planes;
@ -76,6 +76,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
return ret;
}
ep = encoded + buf_size;
/* Set data pointer after line lengths */
dp = encoded + planes * (height << 1);
@ -93,17 +95,19 @@ static int decode_frame(AVCodecContext *avctx, void *data,
for (row = 0; row < height; row++) {
pixptr = frame->data[0] + row * frame->linesize[0] + planemap[p];
pixptr_end = pixptr + frame->linesize[0];
if (ep - lp < row * 2 + 2)
return AVERROR_INVALIDDATA;
dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));
/* Decode a row of this plane */
while (dlen > 0) {
if (dp + 1 >= buf + buf_size)
if (ep - dp <= 1)
return AVERROR_INVALIDDATA;
if ((count = *dp++) <= 127) {
count++;
dlen -= count + 1;
if (pixptr + count * px_inc > pixptr_end)
break;
if (dp + count > buf + buf_size)
if (ep - dp < count)
return AVERROR_INVALIDDATA;
while (count--) {
*pixptr = *dp++;