RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-01-31 20:02:42 +00:00
Code Issues Projects Releases Wiki Activity

pcx: Check the packet size before assuming it fits a palette

Browse Source 
This fixes reads out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit d1d99e3bef)
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>

Conflicts:
	libavcodec/pcx.c
(cherry picked from commit 7e350b7ddd)
This commit is contained in:
Martin Storsjö 2013-09-29 13:02:27 +03:00 committed by Luca Barbato
parent cb4a101fbe
commit d92c908e23
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/pcx.c
View File

@ -183,7 +183,13 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
} else if (nplanes == 1 && bits_per_pixel == 8) {
const uint8_t *palstart = bufstart + buf_size - 769;
for (y=0; y<h; y++, ptr+=stride) {
if (buf_size < 769) {
av_log(avctx, AV_LOG_ERROR, "File is too short\n");
ret = buf_size;
goto end;
}
for (y = 0; y < h; y++, ptr += stride) {
buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
memcpy(ptr, scanline, w);