RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/tdsc: Fix tile checks 

Fixes: out of array access
Fixes: crash.asf

Found-by: anton listov <greyfarn7@yandex.ru>
Reviewed-by: anton listov <greyfarn7@yandex.ru>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 081e3001ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2020-07-15 22:47:50 +02:00
parent ed54e26463
commit fdaead7e23
1 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libavcodec/tdsc.c
View File

@ -390,7 +390,7 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles)
for (i = 0; i < number_tiles; i++) { for (i = 0; i < number_tiles; i++) {
int tile_size; int tile_size;
int tile_mode; int tile_mode;
int x, y, w, h; int x, y, x2, y2, w, h;
int ret; int ret;
if (bytestream2_get_bytes_left(&ctx->gbc) < 4 || if (bytestream2_get_bytes_left(&ctx->gbc) < 4 ||
@ -408,20 +408,19 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles)
bytestream2_skip(&ctx->gbc, 4); // unknown bytestream2_skip(&ctx->gbc, 4); // unknown
x = bytestream2_get_le32(&ctx->gbc); x = bytestream2_get_le32(&ctx->gbc);
y = bytestream2_get_le32(&ctx->gbc); y = bytestream2_get_le32(&ctx->gbc);
w = bytestream2_get_le32(&ctx->gbc) - x; x2 = bytestream2_get_le32(&ctx->gbc);
h = bytestream2_get_le32(&ctx->gbc) - y; y2 = bytestream2_get_le32(&ctx->gbc);
if (x >= ctx->width || y >= ctx->height) { if (x < 0 || y < 0 || x2 <= x || y2 <= y ||
x2 > ctx->width || y2 > ctx->height
) {
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,
"Invalid tile position (%d.%d outside %dx%d).\n", "Invalid tile position (%d.%d %d.%d outside %dx%d).\n",
x, y, ctx->width, ctx->height); x, y, x2, y2, ctx->width, ctx->height);
return AVERROR_INVALIDDATA;
}
if (x + w > ctx->width || y + h > ctx->height) {
av_log(avctx, AV_LOG_ERROR,
"Invalid tile size %dx%d\n", w, h);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
w = x2 - x;
h = y2 - y;
ret = av_reallocp(&ctx->tilebuffer, tile_size); ret = av_reallocp(&ctx->tilebuffer, tile_size);
if (!ctx->tilebuffer) if (!ctx->tilebuffer)