virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/hnm4video: fix write offset checks in decode_interframe_v4()

Browse Source 
Fixes: asan_heap-oob_e76a51_1244_CASSE.HNM

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-11-22 21:55:13 +01:00
parent 5a08ba5381
commit 78446f0d9d
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/hnm4video.c
View File

@ -157,7 +157,12 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s
if (count == 0) { if (count == 0) {
tag = bytestream2_get_byte(&gb) & 0xE0; tag = bytestream2_get_byte(&gb) & 0xE0;
tag = tag >> 5; tag = tag >> 5;
if (tag == 0) { if (tag == 0) {
if (writeoffset + 2 > hnm->width * hnm->height) {
av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
break;
}
hnm->current[writeoffset++] = bytestream2_get_byte(&gb); hnm->current[writeoffset++] = bytestream2_get_byte(&gb);
hnm->current[writeoffset++] = bytestream2_get_byte(&gb); hnm->current[writeoffset++] = bytestream2_get_byte(&gb);
} else if (tag == 1) { } else if (tag == 1) {
@ -168,6 +173,10 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s
writeoffset += count; writeoffset += count;
} else if (tag == 3) { } else if (tag == 3) {
count = bytestream2_get_byte(&gb) * 2; count = bytestream2_get_byte(&gb) * 2;
if (writeoffset + count > hnm->width * hnm->height) {
av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
break;
}
while (count > 0) { while (count > 0) {
hnm->current[writeoffset++] = bytestream2_peek_byte(&gb); hnm->current[writeoffset++] = bytestream2_peek_byte(&gb);
count--; count--;
@ -176,6 +185,10 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s
} else { } else {
break; break;
} }
if (writeoffset > hnm->width * hnm->height) {
av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n");
break;
}
} else { } else {
previous = bytestream2_peek_byte(&gb) & 0x20; previous = bytestream2_peek_byte(&gb) & 0x20;
backline = bytestream2_peek_byte(&gb) & 0x40; backline = bytestream2_peek_byte(&gb) & 0x40;
@ -194,7 +207,7 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s
} else if (backward && offset + 1 >= hnm->width * hnm->height) { } else if (backward && offset + 1 >= hnm->width * hnm->height) {
av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds"); av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds");
break; break;
} else if (writeoffset + count >= hnm->width * hnm->height) { } else if (writeoffset + 2*count > hnm->width * hnm->height) {
av_log(avctx, AV_LOG_ERROR, av_log(avctx, AV_LOG_ERROR,
"Attempting to write out of bounds"); "Attempting to write out of bounds");
break; break;