virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

mdec: check for out of bounds read

Browse Source 
Bug-Id: CID 1257501
CC: libav-stable@libav.org

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
This commit is contained in:
Federico Tomassetti
2015-02-18 12:11:43 +00:00
committed by Luca Barbato
parent fe208ca54b
commit 161442ff2c
1 changed files with 13 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/mdec.c
View File

@@ -87,6 +87,11 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
break; break;
} else if (level != 0) { } else if (level != 0) {
i += run; i += run;
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
j = scantable[i]; j = scantable[i];
level = (level * qscale * quant_matrix[j]) >> 3; level = (level * qscale * quant_matrix[j]) >> 3;
level = (level ^ SHOW_SBITS(re, &a->gb, 1)) - SHOW_SBITS(re, &a->gb, 1); level = (level ^ SHOW_SBITS(re, &a->gb, 1)) - SHOW_SBITS(re, &a->gb, 1);
@@ -97,6 +102,11 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
UPDATE_CACHE(re, &a->gb); UPDATE_CACHE(re, &a->gb);
level = SHOW_SBITS(re, &a->gb, 10); SKIP_BITS(re, &a->gb, 10); level = SHOW_SBITS(re, &a->gb, 10); SKIP_BITS(re, &a->gb, 10);
i += run; i += run;
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR,
"ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
j = scantable[i]; j = scantable[i];
if (level < 0) { if (level < 0) {
level = -level; level = -level;
@@ -108,10 +118,6 @@ static inline int mdec_decode_block_intra(MDECContext *a, int16_t *block, int n)
level = (level - 1) | 1; level = (level - 1) | 1;
} }
} }
if (i > 63) {
av_log(a->avctx, AV_LOG_ERROR, "ac-tex damaged at %d %d\n", a->mb_x, a->mb_y);
return AVERROR_INVALIDDATA;
}
block[j] = level; block[j] = level;
} }