Module: libav Branch: release/11 Commit: f24056c8f0dece9af0f9743dfb97c171af41b2dc
Author: Michael Niedermayer <[email protected]> Committer: Sean McGovern <[email protected]> Date: Thu Jun 21 16:01:52 2012 +0200 smacker: add sanity check for length in smacker_decode_tree() Signed-off-by: Michael Niedermayer <[email protected]> Bug-Id: 1098 Cc: [email protected] Signed-off-by: Sean McGovern <[email protected]> (cherry picked from commit cd4663dc80323ba64989d0c103d51ad3ee0e9c2f) Signed-off-by: Sean McGovern <[email protected]> --- libavcodec/smacker.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c index ffcc286..a2c70f7 100644 --- a/libavcodec/smacker.c +++ b/libavcodec/smacker.c @@ -42,6 +42,7 @@ #define SMKTREE_BITS 9 #define SMK_NODE 0x80000000 +#define SMKTREE_DECODE_MAX_RECURSION 32 /* * Decoder context @@ -97,6 +98,11 @@ enum SmkBlockTypes { */ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t prefix, int length) { + if (length > SMKTREE_DECODE_MAX_RECURSION) { + av_log(NULL, AV_LOG_ERROR, "Maximum tree recursion level exceeded.\n"); + return AVERROR_INVALIDDATA; + } + if(!get_bits1(gb)){ //Leaf if(hc->current >= 256){ av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
