virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-08-10 06:10:52 +02:00
Code Issues Releases Activity

Merge commit 'bd7b4da0f4627bb6c4a7c2575da83fe6b261a21c'

Browse Source 
* commit 'bd7b4da0f4627bb6c4a7c2575da83fe6b261a21c':
  8bps: Bound-check the input buffer

Conflicts:
	libavcodec/8bps.c

See: 66ff90f4a3
Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-07-24 11:41:39 +02:00
parent 82654172ce bd7b4da0f4
commit da0f67b177
1 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/8bps.c
View File

@@ -64,7 +64,7 @@ static int decode_frame(AVCodecContext *avctx, void *data,
unsigned char *pixptr, *pixptr_end; unsigned char *pixptr, *pixptr_end;
unsigned int height = avctx->height; // Real image height unsigned int height = avctx->height; // Real image height
unsigned int dlen, p, row; unsigned int dlen, p, row;
const unsigned char *lp, *dp; const unsigned char *lp, *dp, *ep;
unsigned char count; unsigned char count;
unsigned int planes = c->planes; unsigned int planes = c->planes;
unsigned char *planemap = c->planemap; unsigned char *planemap = c->planemap;
@@ -73,6 +73,8 @@ static int decode_frame(AVCodecContext *avctx, void *data,
if ((ret = ff_get_buffer(avctx, frame, 0)) < 0) if ((ret = ff_get_buffer(avctx, frame, 0)) < 0)
return ret; return ret;
ep = encoded + buf_size;
/* Set data pointer after line lengths */ /* Set data pointer after line lengths */
dp = encoded + planes * (height << 1); dp = encoded + planes * (height << 1);
@@ -84,19 +86,19 @@ static int decode_frame(AVCodecContext *avctx, void *data,
for (row = 0; row < height; row++) { for (row = 0; row < height; row++) {
pixptr = frame->data[0] + row * frame->linesize[0] + planemap[p]; pixptr = frame->data[0] + row * frame->linesize[0] + planemap[p];
pixptr_end = pixptr + frame->linesize[0]; pixptr_end = pixptr + frame->linesize[0];
if(lp - encoded + row*2 + 1 >= buf_size) if (ep - lp < row * 2 + 2)
return -1; return AVERROR_INVALIDDATA;
dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2)); dlen = av_be2ne16(*(const unsigned short *)(lp + row * 2));
/* Decode a row of this plane */ /* Decode a row of this plane */
while (dlen > 0) { while (dlen > 0) {
if (dp + 1 >= buf + buf_size) if (ep - dp <= 1)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
if ((count = *dp++) <= 127) { if ((count = *dp++) <= 127) {
count++; count++;
dlen -= count + 1; dlen -= count + 1;
if (pixptr + count * planes > pixptr_end) if (pixptr + count * planes > pixptr_end)
break; break;
if (dp + count > buf + buf_size) if (ep - dp < count)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
while (count--) { while (count--) {
*pixptr = *dp++; *pixptr = *dp++;