Module: libav Branch: release/0.8 Commit: 5312fb828751109798780f4e17d5f77dfd3d5398
Author: Luca Barbato <[email protected]> Committer: Luca Barbato <[email protected]> Date: Mon Jul 22 23:26:05 2013 +0200 8bps: Bound-check the input buffer Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: [email protected] (cherry picked from commit bd7b4da0f4627bb6c4a7c2575da83fe6b261a21c) Signed-off-by: Luca Barbato <[email protected]> Conflicts: libavcodec/8bps.c --- libavcodec/8bps.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/libavcodec/8bps.c b/libavcodec/8bps.c index de8dd8e..b54c804 100644 --- a/libavcodec/8bps.c +++ b/libavcodec/8bps.c @@ -69,7 +69,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac unsigned char *pixptr, *pixptr_end; unsigned int height = avctx->height; // Real image height unsigned int dlen, p, row; - const unsigned char *lp, *dp; + const unsigned char *lp, *dp, *ep; unsigned char count; unsigned int px_inc; unsigned int planes = c->planes; @@ -85,6 +85,8 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac return -1; } + ep = encoded + buf_size; + /* Set data pointer after line lengths */ dp = encoded + planes * (height << 1); @@ -102,16 +104,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac for(row = 0; row < height; row++) { pixptr = c->pic.data[0] + row * c->pic.linesize[0] + planemap[p]; pixptr_end = pixptr + c->pic.linesize[0]; + if (ep - lp < row * 2 + 2) + return AVERROR_INVALIDDATA; dlen = av_be2ne16(*(const unsigned short *)(lp+row*2)); /* Decode a row of this plane */ while(dlen > 0) { - if(dp + 1 >= buf+buf_size) return -1; + if(ep - dp <= 1) return -1; if ((count = *dp++) <= 127) { count++; dlen -= count + 1; if (pixptr + count * px_inc > pixptr_end) break; - if(dp + count > buf+buf_size) return -1; + if(ep - dp < count) return -1; while(count--) { *pixptr = *dp++; pixptr += px_inc; _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
