diff options
| author | Anton Khirnov <anton@khirnov.net> | 2012-09-29 11:07:58 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2013-02-02 09:54:16 +0100 |
| commit | 440e98574bde9ca606dfea60c7dda8de555067f7 (patch) | |
| tree | de8b96d1b602911c6e18274a14c90f8c9d5670be | |
| parent | 604d72aa0d050a95aefdc15fc57743415af8283b (diff) | |
| download | ffmpeg-440e98574bde9ca606dfea60c7dda8de555067f7.tar.gz | |
indeo4/5: check empty tile size in decode_mb_info().
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Based on a patch by Michael Niedermayer <michaelni@gmx.at>
Fixes CVE-2012-2800
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ae3da0ae5550053583a6f281ea7fd940497ea0d1)
Conflicts:
libavcodec/ivi_common.c
| -rw-r--r-- | libavcodec/indeo5.c | 4 | ||||
| -rw-r--r-- | libavcodec/ivi_common.c | 11 | ||||
| -rw-r--r-- | libavcodec/ivi_common.h | 2 |
3 files changed, 14 insertions, 3 deletions
diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c index bb491fe15a..45460a40fd 100644 --- a/libavcodec/indeo5.c +++ b/libavcodec/indeo5.c @@ -619,8 +619,10 @@ static int decode_band(IVI5DecContext *ctx, int plane_num, tile->is_empty = get_bits1(&ctx->gb); if (tile->is_empty) { - ff_ivi_process_empty_tile(avctx, band, tile, + result = ff_ivi_process_empty_tile(avctx, band, tile, (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3)); + if (result < 0) + break; } else { tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb); diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c index f55371cf73..38cb3a8b33 100644 --- a/libavcodec/ivi_common.c +++ b/libavcodec/ivi_common.c @@ -495,7 +495,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile) return 0; } -void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, +int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, IVITile *tile, int32_t mv_scale) { int x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type; @@ -506,6 +506,13 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch, int mc_type); + if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) { + av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches " + "parameters %d in ivi_process_empty_tile()\n", + tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)); + return AVERROR_INVALIDDATA; + } + offs = tile->ypos * band->pitch + tile->xpos; mb = tile->mbs; ref_mb = tile->ref_mbs; @@ -586,6 +593,8 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, dst += band->pitch; } } + + return 0; } diff --git a/libavcodec/ivi_common.h b/libavcodec/ivi_common.h index cd9847d08a..3a328c469a 100644 --- a/libavcodec/ivi_common.h +++ b/libavcodec/ivi_common.h @@ -325,7 +325,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile); * @param[in] tile pointer to the tile descriptor * @param[in] mv_scale scaling factor for motion vectors */ -void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, +int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band, IVITile *tile, int32_t mv_scale); /** |