diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 04:14:37 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-03 04:14:37 +0100 |
| commit | 70b5583baa3872b3d5399de555b8006777bf80c5 (patch) | |
| tree | 826329dbd24962ccd452d6391a9dd86d84eae79e | |
| parent | 81d4b3af81b52a79f11705ef02d3f48747047404 (diff) | |
| download | ffmpeg-70b5583baa3872b3d5399de555b8006777bf80c5.tar.gz | |
kvmc: Fix out of reference frame reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/kmvc.c | 16 |
1 files changed, 16 insertions, 0 deletions
diff --git a/libavcodec/kmvc.c b/libavcodec/kmvc.c index 6d5af5d657..c79193b2ee 100644 --- a/libavcodec/kmvc.c +++ b/libavcodec/kmvc.c @@ -106,6 +106,10 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; + if ((l0x-mx) + 320*(l0y-my) < 0 || (l0x-mx) + 320*(l0y-my) > 316*196) { + av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); + return AVERROR_INVALIDDATA; + } for (j = 0; j < 16; j++) BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = BLK(ctx->cur, l0x + (j & 3) - mx, l0y + (j >> 2) - my); @@ -127,6 +131,10 @@ static int kmvc_decode_intra_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = val & 0xF; my = val >> 4; + if ((l1x-mx) + 320*(l1y-my) < 0 || (l1x-mx) + 320*(l1y-my) > 318*198) { + av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); + return AVERROR_INVALIDDATA; + } BLK(ctx->cur, l1x, l1y) = BLK(ctx->cur, l1x - mx, l1y - my); BLK(ctx->cur, l1x + 1, l1y) = BLK(ctx->cur, l1x + 1 - mx, l1y - my); @@ -198,6 +206,10 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = (val & 0xF) - 8; my = (val >> 4) - 8; + if ((l0x+mx) + 320*(l0y+my) < 0 || (l0x+mx) + 320*(l0y+my) > 318*198) { + av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); + return AVERROR_INVALIDDATA; + } for (j = 0; j < 16; j++) BLK(ctx->cur, l0x + (j & 3), l0y + (j >> 2)) = BLK(ctx->prev, l0x + (j & 3) + mx, l0y + (j >> 2) + my); @@ -219,6 +231,10 @@ static int kmvc_decode_inter_8x8(KmvcContext * ctx, int w, int h) val = bytestream2_get_byte(&ctx->g); mx = (val & 0xF) - 8; my = (val >> 4) - 8; + if ((l1x+mx) + 320*(l1y+my) < 0 || (l1x+mx) + 320*(l1y+my) > 318*198) { + av_log(ctx->avctx, AV_LOG_ERROR, "Invalid MV\n"); + return AVERROR_INVALIDDATA; + } BLK(ctx->cur, l1x, l1y) = BLK(ctx->prev, l1x + mx, l1y + my); BLK(ctx->cur, l1x + 1, l1y) = BLK(ctx->prev, l1x + 1 + mx, l1y + my); |