RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-24 15:57:00 +00:00
Code Issues Projects Releases Wiki Activity

svq3: Prevent illegal reads while parsing extradata.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 9e1db721c4)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Alex Converse 2012-02-09 20:21:47 -08:00 committed by Reinhard Tartler
parent b0888b8a48
commit f5ce67d837
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
libavcodec/svq3.c
View File

@ -809,7 +809,9 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
MpegEncContext *s = &h->s;
int m;
unsigned char *extradata;
unsigned char *extradata_end;
unsigned int size;
int marker_found = 0;
if (ff_h264_decode_init(avctx) < 0)
return -1;
@ -829,19 +831,26 @@ static av_cold int svq3_decode_init(AVCodecContext *avctx)
/* prowl for the "SEQH" marker in the extradata */
extradata = (unsigned char *)avctx->extradata;
for (m = 0; m < avctx->extradata_size; m++) {
if (!memcmp(extradata, "SEQH", 4))
break;
extradata++;
extradata_end = avctx->extradata + avctx->extradata_size;
if (extradata) {
for (m = 0; m + 8 < avctx->extradata_size; m++) {
if (!memcmp(extradata, "SEQH", 4)) {
marker_found = 1;
break;
}
extradata++;
}
}
/* if a match was found, parse the extra data */
if (extradata && !memcmp(extradata, "SEQH", 4)) {
if (marker_found) {
GetBitContext gb;
int frame_size_code;
size = AV_RB32(&extradata[4]);
if (size > extradata_end - extradata - 8)
return AVERROR_INVALIDDATA;
init_get_bits(&gb, extradata + 8, size*8);
/* 'frame size code' and optional 'width, height' */