diff options
| author | Anton Khirnov <anton@khirnov.net> | 2012-09-29 13:25:28 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-10-14 16:03:23 -0400 |
| commit | 0c19855539d7431b41b39d911486c193ed5d70d4 (patch) | |
| tree | 42ac440401054610b265721c10a0fbb9a7244229 | |
| parent | d0267ecf768b9f07a488cdc0ac716d699675daaa (diff) | |
| download | ffmpeg-0c19855539d7431b41b39d911486c193ed5d70d4.tar.gz | |
dfa: improve boundary checks in decode_dds1()
Fixes CVE-2012-2798
CC:libav-stable@libav.org
(cherry picked from commit d05f72c75445969cd7bdb1d860635c9880c67fb6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/dfa.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavcodec/dfa.c b/libavcodec/dfa.c index d106d719cb..c2f8002c69 100644 --- a/libavcodec/dfa.c +++ b/libavcodec/dfa.c @@ -153,8 +153,7 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height bitbuf = bytestream2_get_le16u(gb); mask = 1; } - if (frame_end - frame < 2) - return AVERROR_INVALIDDATA; + if (bitbuf & mask) { v = bytestream2_get_le16(gb); offset = (v & 0x1FFF) << 2; @@ -168,9 +167,12 @@ static int decode_dds1(GetByteContext *gb, uint8_t *frame, int width, int height frame += 2; } } else if (bitbuf & (mask << 1)) { - frame += bytestream2_get_le16(gb) * 2; + v = bytestream2_get_le16(gb)*2; + if (frame - frame_end < v) + return AVERROR_INVALIDDATA; + frame += v; } else { - if (frame_end - frame < width + 2) + if (frame_end - frame < width + 3) return AVERROR_INVALIDDATA; frame[0] = frame[1] = frame[width] = frame[width + 1] = bytestream2_get_byte(gb); |