diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2016-02-25 21:04:36 +0100 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2016-02-28 13:32:01 +0100 |
| commit | 0f199f0ad01ea4504edcfd947c85cfa69292f881 (patch) | |
| tree | 8671ad0cf6335423c03e6461898bb97a1499ed79 | |
| parent | 5d18dc37953966422ad1b64a395ce54b9a641081 (diff) | |
| download | ffmpeg-0f199f0ad01ea4504edcfd947c85cfa69292f881.tar.gz | |
mss2: Fix buffer overflow.
Reported as https://trac.mplayerhq.hu/ticket/2264 but have
not been able to reproduce with FFmpeg-only.
I have no idea what coded_height is used for here exactly,
so this might not be the best fix.
Fixes the following chain of events:
ff_mss12_decode_init sets coded_height while not setting height.
ff_mpv_decode_init then copies coded_height into MpegEncContext height.
This is then used by init_context_frame to allocate the data structures.
However the wmv9rects are validated/initialized based on avctx->height, not
avctx->coded_height.
Thus the decode_wmv9 function will try to decode a larger video that we
allocated data structures for, causing out-of-bounds writes.
Signed-off-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
| -rw-r--r-- | libavcodec/mss12.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mss12.c b/libavcodec/mss12.c index 6b58aa2955..d42093b0a3 100644 --- a/libavcodec/mss12.c +++ b/libavcodec/mss12.c @@ -581,8 +581,8 @@ av_cold int ff_mss12_decode_init(MSS12Context *c, int version, return AVERROR_INVALIDDATA; } - avctx->coded_width = AV_RB32(avctx->extradata + 20); - avctx->coded_height = AV_RB32(avctx->extradata + 24); + avctx->coded_width = FFMAX(AV_RB32(avctx->extradata + 20), avctx->width); + avctx->coded_height = FFMAX(AV_RB32(avctx->extradata + 24), avctx->height); if (avctx->coded_width > 4096 || avctx->coded_height > 4096) { av_log(avctx, AV_LOG_ERROR, "Frame dimensions %dx%d too large", avctx->coded_width, avctx->coded_height); |