Module: libav Branch: release/0.7 Commit: 44da556815fc02ed0c763e8e8bda3ea7824b7954
Author: Michael Niedermayer <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Sat Apr 14 18:28:31 2012 +0200 lagarith: check count before writing zeros. Fixes CVE-2012-2793 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <[email protected]> (cherry picked from commit b631e4ed64f7d1b9ca8f897fda31140e8d1fad81) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/lagarith.c | 5 +++++ 1 files changed, 5 insertions(+), 0 deletions(-) diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c index 3d53536..5e00a75 100644 --- a/libavcodec/lagarith.c +++ b/libavcodec/lagarith.c @@ -322,6 +322,11 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst, output_zeros: if (l->zeros_rem) { count = FFMIN(l->zeros_rem, width - i); + if (end - dst < count) { + av_log(l->avctx, AV_LOG_ERROR, "Too many zeros remaining.\n"); + return AVERROR_INVALIDDATA; + } + memset(dst, 0, count); l->zeros_rem -= count; dst += count; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
