Module: libav Branch: release/9 Commit: 04c29196ad70af4efe656a777cfbf6a02404303c
Author: Luca Barbato <[email protected]> Committer: Reinhard Tartler <[email protected]> Date: Mon Jun 10 16:37:43 2013 +0200 4xm: check bitstream_size boundary before using it Prevent buffer overread. Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] (cherry picked from commit 59d7bb99b6a963b7e11c637228b2203adf535eee) Signed-off-by: Reinhard Tartler <[email protected]> --- libavcodec/4xm.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 5602f62..cf9ad72 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -733,6 +733,9 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length) unsigned int prestream_size; const uint8_t *prestream; + if (bitstream_size > (1 << 26)) + return AVERROR_INVALIDDATA; + if (length < bitstream_size + 12) { av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n"); return AVERROR_INVALIDDATA; @@ -743,7 +746,6 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length) prestream = buf + bitstream_size + 12; if (prestream_size + bitstream_size + 12 != length - || bitstream_size > (1 << 26) || prestream_size > (1 << 26)) { av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d %d\n", prestream_size, bitstream_size, length); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
