virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-28 20:53:54 +02:00
Code Issues Releases Activity

avcodec/hevc: Check entry_point_offsets

Browse Source 
Fixes out of array read
Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit ef9f7bbfa4)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2015-11-27 18:30:05 +01:00
parent 1f6aea2cc4
commit 6157938408
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/hevc.c
View File

@ -2420,7 +2420,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)
HEVCLocalContext *lc = s->HEVClc;
int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
int offset;
int64_t offset;
int startheader, cmpt = 0;
int i, j, res = 0;
@ -2467,6 +2467,11 @@ static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)
}
if (s->sh.num_entry_point_offsets != 0) {
offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;
if (length < offset) {
av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");
res = AVERROR_INVALIDDATA;
goto error;
}
s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;
s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;
@ -2493,6 +2498,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const uint8_t *nal, int length)
for (i = 0; i <= s->sh.num_entry_point_offsets; i++)
res += ret[i];
error:
av_free(ret);
av_free(arg);
return res;