virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

xan: check for vector_segment overread

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-04-15 15:36:38 +02:00
parent b962932cba
commit b1096b6ee7
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/xan.c
View File

@ -288,6 +288,7 @@ static int xan_wc3_decode_frame(XanContext *s) {
const unsigned char *size_segment; const unsigned char *size_segment;
const unsigned char *vector_segment; const unsigned char *vector_segment;
const unsigned char *imagedata_segment; const unsigned char *imagedata_segment;
const unsigned char *buf_end = s->buf + s->size;
int huffman_offset, size_offset, vector_offset, imagedata_offset, int huffman_offset, size_offset, vector_offset, imagedata_offset,
imagedata_size; imagedata_size;
@ -392,6 +393,10 @@ static int xan_wc3_decode_frame(XanContext *s) {
imagedata_size -= size; imagedata_size -= size;
} }
} else { } else {
if (vector_segment >= buf_end) {
av_log(s->avctx, AV_LOG_ERROR, "vector_segment overread\n");
return AVERROR_INVALIDDATA;
}
/* run-based motion compensation from last frame */ /* run-based motion compensation from last frame */
motion_x = sign_extend(*vector_segment >> 4, 4); motion_x = sign_extend(*vector_segment >> 4, 4);
motion_y = sign_extend(*vector_segment & 0xF, 4); motion_y = sign_extend(*vector_segment & 0xF, 4);