RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/vp8: Check buffer size in vp8_decode_frame_header() 

avoids null pointer dereference
Fixes: signal_sigsegv_d5de40_964_vp80-00-comprehensive-010.ivf with memlimit of 1048576

Found-by: Samuel Groß, Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 599d746e07)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-07-18 19:18:24 +02:00
parent 8fe79605fd
commit d2b0aae5e1
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/vp8.c
View File

@ -633,6 +633,11 @@ static int vp8_decode_frame_header(VP8Context *s, const uint8_t *buf, int buf_si
int width = s->avctx->width; int width = s->avctx->width;
int height = s->avctx->height; int height = s->avctx->height;
if (buf_size < 3) {
av_log(s->avctx, AV_LOG_ERROR, "Insufficent data (%d) for header\n", buf_size);
return AVERROR_INVALIDDATA;
}
s->keyframe = !(buf[0] & 1); s->keyframe = !(buf[0] & 1);
s->profile = (buf[0]>>1) & 7; s->profile = (buf[0]>>1) & 7;
s->invisible = !(buf[0] & 0x10); s->invisible = !(buf[0] & 0x10);