From e61b25e2557394e640a5aae901473785a4b23db5 Mon Sep 17 00:00:00 2001
From: maryam ebr <me22bee@outlook.com>
Date: Tue, 3 Aug 2021 01:05:47 -0400
Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7150f9575671f898382c370acae35f9087a30ba1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
libavcodec/dnxhddec.c | 22 +++++++++++++++-------
1 file changed, 15 insertions(+), 7 deletions(-)
diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c
index 1f93f9dfc2..505a51d3ea 100644
--- a/libavcodec/dnxhddec.c
+++ b/libavcodec/dnxhddec.c
@@ -107,6 +107,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
{
+ int ret;
if (cid != ctx->cid) {
int index;
@@ -126,19 +127,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
ff_free_vlc(&ctx->dc_vlc);
ff_free_vlc(&ctx->run_vlc);
- init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
+ if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
ctx->cid_table->ac_bits, 1, 1,
- ctx->cid_table->ac_codes, 2, 2, 0);
- init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
+ ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
+ goto out;
+ if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
ctx->cid_table->dc_bits, 1, 1,
- ctx->cid_table->dc_codes, 1, 1, 0);
- init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
+ ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
+ goto out;
+ if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
ctx->cid_table->run_bits, 1, 1,
- ctx->cid_table->run_codes, 2, 2, 0);
+ ctx->cid_table->run_codes, 2, 2, 0)) < 0)
+ goto out;
ctx->cid = cid;
}
- return 0;
+ ret = 0;
+out:
+ if (ret < 0)
+ av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
+ return ret;
}
static av_cold int dnxhd_decode_init_thread_copy(AVCodecContext *avctx)