Module: libav Branch: master Commit: 2d09cdbaf2f449ba23d54e97e94bd97ca22208c6
Author: Michael Niedermayer <[email protected]> Committer: Anton Khirnov <[email protected]> Date: Sun Apr 15 14:11:50 2012 +0200 indeo5: check tile size in decode_mb_info(). This prevents writing into a too small array if some parameters changed without the tile being reallocated. Fixes CVE-2012-2794 CC:[email protected] Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <[email protected]> --- libavcodec/indeo5.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c index 4f8e0d8..4044a04 100644 --- a/libavcodec/indeo5.c +++ b/libavcodec/indeo5.c @@ -430,6 +430,12 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, ((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv)) return AVERROR_INVALIDDATA; + if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) { + av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches parameters %d\n", + tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)); + return AVERROR_INVALIDDATA; + } + /* scale factor for motion vectors */ mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); mv_x = mv_y = 0; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
