[libav-devel] [PATCH] kmvc: Use bytestream2 functions to prevent buffer overreads.

[Laurentiu Ion]

---
 libavcodec/kmvc.c |   26 +++++++++++++-------------
 1 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/libavcodec/kmvc.c b/libavcodec/kmvc.c
index 6c55863..d0dbdd3 100644
--- a/libavcodec/kmvc.c
+++ b/libavcodec/kmvc.c
@@ -276,8 +276,7 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, const 
uint8_t * src, int src
 
 static int decode_frame(AVCodecContext * avctx, void *data, int *data_size, 
AVPacket *avpkt)
 {
-    const uint8_t *buf = avpkt->data;
-    int buf_size = avpkt->size;
+    GetByteContext g;
     KmvcContext *const ctx = avctx->priv_data;
     uint8_t *out, *src;
     int i;
@@ -285,6 +284,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, 
int *data_size, AVPa
     int blocksize;
     const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE, 
NULL);
 
+    bytestream2_init(&g, avpkt->data, avpkt->size);
     if (ctx->pic.data[0])
         avctx->release_buffer(avctx, &ctx->pic);
 
@@ -295,16 +295,16 @@ static int decode_frame(AVCodecContext * avctx, void 
*data, int *data_size, AVPa
         return -1;
     }
 
-    header = *buf++;
+    header = bytestream2_get_byte(&g);
 
     /* blocksize 127 is really palette change event */
-    if (buf[0] == 127) {
-        buf += 3;
+    if (bytestream2_get_byte(&g) == 127) {
+        bytestream2_skip(&g, 2);
         for (i = 0; i < 127; i++) {
-            ctx->pal[i + (header & 0x81)] = AV_RB24(buf);
-            buf += 4;
+            ctx->pal[i + (header & 0x81)] = bytestream2_get_be24(&g);
+            bytestream2_skip(&g, 1);
         }
-        buf -= 127 * 4 + 3;
+        bytestream2_seek(&g, 127 * 4 + 3, SEEK_CUR);
     }
 
     if (header & KMVC_KEYFRAME) {
@@ -319,7 +319,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, 
int *data_size, AVPa
         ctx->pic.palette_has_changed = 1;
         // palette starts from index 1 and has 127 entries
         for (i = 1; i <= ctx->palsize; i++) {
-            ctx->pal[i] = bytestream_get_be24(&buf);
+            ctx->pal[i] = bytestream2_get_be24(&g);
         }
     }
 
@@ -336,7 +336,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, 
int *data_size, AVPa
     /* make the palette available on the way out */
     memcpy(ctx->pic.data[1], ctx->pal, 1024);
 
-    blocksize = *buf++;
+    blocksize = bytestream2_get_byte(&g);
 
     if (blocksize != 8 && blocksize != 127) {
         av_log(avctx, AV_LOG_ERROR, "Block size = %i\n", blocksize);
@@ -349,10 +349,10 @@ static int decode_frame(AVCodecContext * avctx, void 
*data, int *data_size, AVPa
         memcpy(ctx->cur, ctx->prev, 320 * 200);
         break;
     case 3:
-        kmvc_decode_intra_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
+        kmvc_decode_intra_8x8(ctx, avpkt->data, avpkt->size, avctx->width, 
avctx->height);
         break;
     case 4:
-        kmvc_decode_inter_8x8(ctx, buf, buf_size, avctx->width, avctx->height);
+        kmvc_decode_inter_8x8(ctx, avpkt->data, avpkt->size, avctx->width, 
avctx->height);
         break;
     default:
         av_log(avctx, AV_LOG_ERROR, "Unknown compression method %i\n", header 
& KMVC_METHOD);
@@ -380,7 +380,7 @@ static int decode_frame(AVCodecContext * avctx, void *data, 
int *data_size, AVPa
     *(AVFrame *) data = ctx->pic;
 
     /* always report that the buffer was completely consumed */
-    return buf_size;
+    return avpkt->size,;
 }
 
 
-- 
1.7.5.4

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel