From 29545741266a03332f2758c7ba4f77f362c3668d Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 23 Apr 2012 21:40:02 +0200 Subject: [PATCH] indeo4: check quant_mat more fully. quant_mats valid range depends on the block size. This fixes a global array overread. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/indeo4.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 45ff6197c5..6615b63ce2 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -420,7 +420,11 @@ static int decode_band_hdr(IVI4DecContext *ctx, IVIBandDesc *band, } band->quant_mat = quant_mat; } - + if (quant_index_to_tab[band->quant_mat] > 4 && band->blk_size == 4) { + av_log(avctx, AV_LOG_ERROR, "Invalid quant matrix for 4x4 block encountered!\n"); + band->quant_mat = 0; + return AVERROR_INVALIDDATA; + } /* decode block huffman codebook */ if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF, &band->blk_vlc, avctx))