virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

4xm: validate the buffer size before parsing it

Browse Source 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-06-07 16:16:46 +02:00
parent 145023f572
commit de2e5777e2
1 changed files with 17 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
libavcodec/4xm.c
View File

@ -418,6 +418,8 @@ static int decode_p_frame(FourXContext *f, AVFrame *frame,
src = (uint16_t *)f->last_picture->data[0];
if (f->version > 1) {
if (length < 20)
return AVERROR_INVALIDDATA;
extra = 20;
bitstream_size = AV_RL32(buf + 8);
wordstream_size = AV_RL32(buf + 12);
@ -788,18 +790,29 @@ static int decode_frame(AVCodecContext *avctx, void *data,
AVFrame *picture = data;
int i, frame_4cc, frame_size, ret;
frame_4cc = AV_RL32(buf);
if (buf_size != AV_RL32(buf + 4) + 8 || buf_size < 20)
if (buf_size < 20)
return AVERROR_INVALIDDATA;
if (buf_size < AV_RL32(buf + 4) + 8) {
av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d\n",
buf_size, AV_RL32(buf + 4));
return AVERROR_INVALIDDATA;
}
frame_4cc = AV_RL32(buf);
if (frame_4cc == AV_RL32("cfrm")) {
int free_index = -1;
int id, whole_size;
const int data_size = buf_size - 20;
const int id = AV_RL32(buf + 12);
const int whole_size = AV_RL32(buf + 16);
CFrameBuffer *cfrm;
if (data_size < 0)
return AVERROR_INVALIDDATA;
id = AV_RL32(buf + 12);
whole_size = AV_RL32(buf + 16);
for (i = 0; i < CFRAME_BUFFER_COUNT; i++)
if (f->cfrm[i].id && f->cfrm[i].id < avctx->frame_number)
av_log(f->avctx, AV_LOG_ERROR, "lost c frame %d\n",