RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avformat/mlvdec: Only store dimensions after having validated them 

Otherwise it might happen that invalid dimensions are used when reading
a video packet; this might lead to undefined overflow.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
This commit is contained in:
Andreas Rheinhardt 2020-08-10 02:33:19 +02:00
parent 0d560873da
commit d661cfc184
1 changed files with 11 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavformat/mlvdec.c
View File

@ -132,23 +132,25 @@ static int scan_file(AVFormatContext *avctx, AVStream *vst, AVStream *ast, int f
break;
size -= 16;
if (vst && type == MKTAG('R','A','W','I') && size >= 164) {
vst->codecpar->width = avio_rl16(pb);
vst->codecpar->height = avio_rl16(pb);
ret = av_image_check_size(vst->codecpar->width, vst->codecpar->height, 0, avctx);
unsigned width = avio_rl16(pb);
unsigned height = avio_rl16(pb);
unsigned bits_per_coded_sample;
ret = av_image_check_size(width, height, 0, avctx);
if (ret < 0)
return ret;
if (avio_rl32(pb) != 1)
avpriv_request_sample(avctx, "raw api version");
avio_skip(pb, 20); // pointer, width, height, pitch, frame_size
vst->codecpar->bits_per_coded_sample = avio_rl32(pb);
if (vst->codecpar->bits_per_coded_sample < 0 ||
vst->codecpar->bits_per_coded_sample > (INT_MAX - 7) / (vst->codecpar->width * vst->codecpar->height)) {
bits_per_coded_sample = avio_rl32(pb);
if (bits_per_coded_sample > (INT_MAX - 7) / (width * height)) {
av_log(avctx, AV_LOG_ERROR,
"invalid bits_per_coded_sample %d (size: %dx%d)\n",
vst->codecpar->bits_per_coded_sample,
vst->codecpar->width, vst->codecpar->height);
"invalid bits_per_coded_sample %u (size: %ux%u)\n",
bits_per_coded_sample, width, height);
return AVERROR_INVALIDDATA;
}
vst->codecpar->width = width;
vst->codecpar->height = height;
vst->codecpar->bits_per_coded_sample = bits_per_coded_sample;
avio_skip(pb, 8 + 16 + 24); // black_level, white_level, xywh, active_area, exposure_bias
if (avio_rl32(pb) != 0x2010100) /* RGGB */
avpriv_request_sample(avctx, "cfa_pattern");