RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/hevc: Check entry_point_offsets 

Fixes out of array read
Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-11-27 18:30:05 +01:00
parent ec0719264c
commit ef9f7bbfa4
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/hevc.c
View File

@ -2442,7 +2442,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
HEVCLocalContext *lc = s->HEVClc;
int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
int offset;
int64_t offset;
int startheader, cmpt = 0;
int i, j, res = 0;
@ -2489,6 +2489,11 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
}
if (s->sh.num_entry_point_offsets != 0) {
offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;
if (length < offset) {
av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");
res = AVERROR_INVALIDDATA;
goto error;
}
s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;
s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;
@ -2515,6 +2520,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
for (i = 0; i <= s->sh.num_entry_point_offsets; i++)
res += ret[i];
error:
av_free(ret);
av_free(arg);
return res;