aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-01-25 04:51:06 +0100
committerMichael Niedermayer <michaelni@gmx.at>2012-01-26 20:10:26 +0100
commit88d84dd8eacd4edfe29f12209f10733d631ca5ae (patch)
tree0741f8780b7f1c71b662d6ca811959c9c4ce2469
parent8847561f93c8e44095324a2c16ba78adf1a7511a (diff)
downloadffmpeg-88d84dd8eacd4edfe29f12209f10733d631ca5ae.tar.gz
dv: Fix out of array read
Fixes part of CVE-2011-3936 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/dv.c10
1 files changed, 6 insertions, 4 deletions
diff --git a/libavformat/dv.c b/libavformat/dv.c
index 86ed1e954e..666e3317ab 100644
--- a/libavformat/dv.c
+++ b/libavformat/dv.c
@@ -35,6 +35,7 @@
#include "libavutil/intreadwrite.h"
#include "libavutil/mathematics.h"
#include "dv.h"
+#include "libavutil/avassert.h"
struct DVDemuxContext {
const DVprofile* sys; /* Current DV profile. E.g.: 525/60, 625/50 */
@@ -130,15 +131,19 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
/* We work with 720p frames split in half, thus even frames have
* channels 0,1 and odd 2,3. */
ipcm = (sys->height == 720 && !(frame[1] & 0x0C)) ? 2 : 0;
- pcm = ppcm[ipcm++];
/* for each DIF channel */
for (chan = 0; chan < sys->n_difchan; chan++) {
+ av_assert0(ipcm<4);
+ pcm = ppcm[ipcm++];
+ if (!pcm)
+ break;
/* for each DIF segment */
for (i = 0; i < sys->difseg_size; i++) {
frame += 6 * 80; /* skip DIF segment header */
if (quant == 1 && i == half_ch) {
/* next stereo channel (12bit mode only) */
+ av_assert0(ipcm<4);
pcm = ppcm[ipcm++];
if (!pcm)
break;
@@ -183,9 +188,6 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
}
/* next stereo channel (50Mbps and 100Mbps only) */
- pcm = ppcm[ipcm++];
- if (!pcm)
- break;
}
return size;