dvdsub_decode() can call append_to_cached_buf() 2 times, the second time
with ctx->buf as argument. If the second append_to_cached_buf() reallocs
ctx->buf, the argument will be a pointer to the previous, freed block.
This can cause invalid reads at least with some fuzzed files - and
possibly with valid files.
Since packets can apparently not be larger than 64K (even if packets are
combined), just use a fixed size buffer. It will be allocated as part of
the DVDSubContext, and although some memory is "wasted", it's relatively
minimal by modern standards and should be acceptable.
---
Not sure if GetBitContext needs stricter padding and alignment for this
buffer?
---
libavcodec/dvdsubdec.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c
index 1cc34ea..9e5ca0a 100644
--- a/libavcodec/dvdsubdec.c
+++ b/libavcodec/dvdsubdec.c
@@ -39,7 +39,7 @@ typedef struct DVDSubContext
int has_palette;
uint8_t colormap[4];
uint8_t alpha[256];
- uint8_t *buf;
+ uint8_t buf[0x10000];
int buf_size;
int forced_subs_only;
#ifdef DEBUG
@@ -512,12 +512,8 @@ static int append_to_cached_buf(AVCodecContext *avctx,
if (ctx->buf_size > 0xffff - buf_size) {
av_log(avctx, AV_LOG_WARNING, "Attempt to reconstruct "
"too large SPU packets aborted.\n");
- av_freep(&ctx->buf);
return AVERROR_INVALIDDATA;
}
- ctx->buf = av_realloc(ctx->buf, ctx->buf_size + buf_size);
- if (!ctx->buf)
- return AVERROR(ENOMEM);
memcpy(ctx->buf + ctx->buf_size, buf, buf_size);
ctx->buf_size += buf_size;
return 0;
@@ -575,7 +571,6 @@ static int dvdsub_decode(AVCodecContext *avctx,
}
#endif
- av_freep(&ctx->buf);
ctx->buf_size = 0;
*data_size = 1;
return buf_size;
@@ -719,7 +714,6 @@ static av_cold int dvdsub_init(AVCodecContext *avctx)
static av_cold int dvdsub_close(AVCodecContext *avctx)
{
DVDSubContext *ctx = avctx->priv_data;
- av_freep(&ctx->buf);
ctx->buf_size = 0;
return 0;
}
--
2.1.4
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
