Module: libav Branch: release/0.8 Commit: 12dc01bb1f07112cd7eb31e183d75cb3c0fb92ca
Author: Luca Barbato <[email protected]> Committer: Luca Barbato <[email protected]> Date: Fri Jun 7 16:18:22 2013 +0200 4xm: do not overread the prestream buffer Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] (cherry picked from commit be373cb50d3c411366fec7eef2eb3681abe48f96) Signed-off-by: Luca Barbato <[email protected]> --- libavcodec/4xm.c | 15 +++++++++++++-- 1 file changed, 13 insertions(+), 2 deletions(-) diff --git a/libavcodec/4xm.c b/libavcodec/4xm.c index 52c16cf..3d026fe 100644 --- a/libavcodec/4xm.c +++ b/libavcodec/4xm.c @@ -535,7 +535,10 @@ static int decode_i_mb(FourXContext *f){ return 0; } -static const uint8_t *read_huffman_tables(FourXContext *f, const uint8_t * const buf){ +static const uint8_t *read_huffman_tables(FourXContext *f, + const uint8_t * const buf, + int len) +{ int frequency[512]; uint8_t flag[512]; int up[512]; @@ -553,12 +556,20 @@ static const uint8_t *read_huffman_tables(FourXContext *f, const uint8_t * const for(;;){ int i; + len -= end - start + 1; + + if (end < start || len < 0) + return NULL; + for(i=start; i<=end; i++){ frequency[i]= *ptr++; } start= *ptr++; if(start==0) break; + if (--len < 0) + return NULL; + end= *ptr++; } frequency[256]=1; @@ -691,7 +702,7 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){ return -1; } - prestream = read_huffman_tables(f, prestream); + prestream = read_huffman_tables(f, prestream, prestream_size); if (!prestream) { av_log(f->avctx, AV_LOG_ERROR, "Error reading Huffman tables.\n"); return AVERROR_INVALIDDATA; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
