virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-04-19 09:02:26 +02:00
Code Issues Releases Activity

rv30: fix extradata size check.

Browse Source 
It has been checking the number of bits in the offset instead of the
actual offset.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov 2013-11-28 10:54:35 +01:00
parent feded990e3
commit a6a2282c25
1 changed files with 9 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/rv30.c
View File

@ -34,6 +34,7 @@
static int rv30_parse_slice_header(RV34DecContext *r, GetBitContext *gb, SliceInfo *si) static int rv30_parse_slice_header(RV34DecContext *r, GetBitContext *gb, SliceInfo *si)
{ {
AVCodecContext *avctx = r->s.avctx;
int mb_bits; int mb_bits;
int w = r->s.width, h = r->s.height; int w = r->s.width, h = r->s.height;
int mb_size; int mb_size;
@ -51,6 +52,13 @@ static int rv30_parse_slice_header(RV34DecContext *r, GetBitContext *gb, SliceIn
si->pts = get_bits(gb, 13); si->pts = get_bits(gb, 13);
rpr = get_bits(gb, r->rpr); rpr = get_bits(gb, r->rpr);
if(rpr){ if(rpr){
if (avctx->extradata_size < rpr * 2 + 8) {
av_log(avctx, AV_LOG_ERROR,
"Insufficient extradata - need at least %d bytes, got %d\n",
8 + rpr * 2, avctx->extradata_size);
return AVERROR(EINVAL);
}
w = r->s.avctx->extradata[6 + rpr*2] << 2; w = r->s.avctx->extradata[6 + rpr*2] << 2;
h = r->s.avctx->extradata[7 + rpr*2] << 2; h = r->s.avctx->extradata[7 + rpr*2] << 2;
} }
@ -254,11 +262,7 @@ static av_cold int rv30_decode_init(AVCodecContext *avctx)
} }
r->rpr = (avctx->extradata[1] & 7) >> 1; r->rpr = (avctx->extradata[1] & 7) >> 1;
r->rpr = FFMIN(r->rpr + 1, 3); r->rpr = FFMIN(r->rpr + 1, 3);
if(avctx->extradata_size - 8 < (r->rpr - 1) * 2){
av_log(avctx, AV_LOG_ERROR, "Insufficient extradata - need at least %d bytes, got %d\n",
6 + r->rpr * 2, avctx->extradata_size);
return AVERROR(EINVAL);
}
r->parse_slice_header = rv30_parse_slice_header; r->parse_slice_header = rv30_parse_slice_header;
r->decode_intra_types = rv30_decode_intra_types; r->decode_intra_types = rv30_decode_intra_types;
r->decode_mb_info = rv30_decode_mb_info; r->decode_mb_info = rv30_decode_mb_info;