virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-02-09 14:14:39 +02:00
Code Issues Releases Activity

indeo4: Decode all or nothing of a band header.

Browse Source 
This avoids inconsistent value combinations.
Alternatively it would be possible to add more checks and careful use of
temporary variables, but my try of this quickly seemed to become
a rather large change.
The disadvantage of this, is that the struct is copied back and forth.

Fixes: index 6 out of bounds for type 'const uint16_t [5][16]'
Fixes: 6557/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_INDEO4_fuzzer-4787296550256640

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 10c8521265da86118597336c5589e26de377a374)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-05-17 13:40:38 +02:00
parent 854835966b
commit 931f837731
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/indeo4.c
View File

@ -269,12 +269,14 @@ static int decode_pic_hdr(IVI45DecContext *ctx, AVCodecContext *avctx)
* @param[in] avctx pointer to the AVCodecContext * @param[in] avctx pointer to the AVCodecContext
* @return result code: 0 = OK, negative number = error * @return result code: 0 = OK, negative number = error
*/ */
static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *arg_band,
AVCodecContext *avctx) AVCodecContext *avctx)
{ {
int plane, band_num, indx, transform_id, scan_indx; int plane, band_num, indx, transform_id, scan_indx;
int i; int i;
int quant_mat; int quant_mat;
IVIBandDesc temp_band, *band = &temp_band;
memcpy(&temp_band, arg_band, sizeof(temp_band));
plane = get_bits(&ctx->gb, 2); plane = get_bits(&ctx->gb, 2);
band_num = get_bits(&ctx->gb, 4); band_num = get_bits(&ctx->gb, 4);
@ -408,10 +410,10 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
/* decode block huffman codebook */ /* decode block huffman codebook */
if (!get_bits1(&ctx->gb)) if (!get_bits1(&ctx->gb))
band->blk_vlc.tab = ctx->blk_vlc.tab; arg_band->blk_vlc.tab = ctx->blk_vlc.tab;
else else
if (ff_ivi_dec_huff_desc(&ctx->gb, 1, IVI_BLK_HUFF, if (ff_ivi_dec_huff_desc(&ctx->gb, 1, IVI_BLK_HUFF,
&band->blk_vlc, avctx)) &arg_band->blk_vlc, avctx))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
/* select appropriate rvmap table for this band */ /* select appropriate rvmap table for this band */
@ -452,6 +454,9 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
band->blk_vlc = arg_band->blk_vlc;
memcpy(arg_band, band, sizeof(*arg_band));
return 0; return 0;
} }