virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-03-23 04:24:35 +02:00
Code Issues Releases Activity

avcodec/mscc & mwsc: Check loop counts before use

Browse Source 
This could cause timeouts

Fixes: CID1439568 Untrusted loop bound

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit e35fe3d8b9e345527a05b1ae958ac851fe09f1ed)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-05-12 00:43:48 +02:00
parent cb4e45231c
commit 21fe5ce693
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
2 changed files with 17 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/mscc.c
View File

@ -54,6 +54,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont
unsigned run = bytestream2_get_byte(gb);
if (run) {
if (bytestream2_get_bytes_left_p(pb) < run * s->bpp)
return AVERROR_INVALIDDATA;
switch (avctx->bits_per_coded_sample) {
case 8:
fill = bytestream2_get_byte(gb);
@ -102,6 +105,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont
bytestream2_seek_p(pb, y * avctx->width * s->bpp + x * s->bpp, SEEK_SET);
} else {
if (bytestream2_get_bytes_left_p(pb) < copy * s->bpp)
return AVERROR_INVALIDDATA;
for (j = 0; j < copy; j++) {
switch (avctx->bits_per_coded_sample) {
case 8:

11
libavcodec/mwsc.c
View File

@ -52,6 +52,10 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext
if (run == 0) {
run = bytestream2_get_le32(gb);
if (bytestream2_tell_p(pb) + width - w < run)
return AVERROR_INVALIDDATA;
for (int j = 0; j < run; j++, w++) {
if (w == width) {
w = 0;
@ -63,6 +67,10 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext
int pos = bytestream2_tell_p(pb);
bytestream2_seek(gbp, pos, SEEK_SET);
if (pos + width - w < fill)
return AVERROR_INVALIDDATA;
for (int j = 0; j < fill; j++, w++) {
if (w == width) {
w = 0;
@ -74,6 +82,9 @@ static int rle_uncompress(GetByteContext *gb, PutByteContext *pb, GetByteContext
intra = 0;
} else {
if (bytestream2_tell_p(pb) + width - w < run)
return AVERROR_INVALIDDATA;
for (int j = 0; j < run; j++, w++) {
if (w == width) {
w = 0;