diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-06 16:08:10 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-01 18:33:29 +0200 |
| commit | 4924520513d06b4d9169a1d3e0374d5a48bc02e0 (patch) | |
| tree | f8c1dce590ab46b8e6cdc270c68d140548e26a36 | |
| parent | f2e412d050ae9a0dcdea515f1c02620c6dcf8c47 (diff) | |
| download | ffmpeg-4924520513d06b4d9169a1d3e0374d5a48bc02e0.tar.gz | |
raw: move buffer size check up.
This way, it protects against overreads for 4bpp/2bpp content also.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cc5dd632cecc5114717d0b90f8c2be162b1c6ee8)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavcodec/rawdec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c index 5e8e6c4c43..05a032e62c 100644 --- a/libavcodec/rawdec.c +++ b/libavcodec/rawdec.c @@ -127,6 +127,9 @@ static int raw_decode(AVCodecContext *avctx, frame->reordered_opaque = avctx->reordered_opaque; frame->pkt_pts = avctx->pkt->pts; + if(buf_size < context->length - (avctx->pix_fmt==PIX_FMT_PAL8 ? 256*4 : 0)) + return -1; + //2bpp and 4bpp raw in avi and mov (yes this is ugly ...) if (context->buffer) { int i; @@ -151,9 +154,6 @@ static int raw_decode(AVCodecContext *avctx, avctx->codec_tag == MKTAG('A', 'V', 'u', 'p')) buf += buf_size - context->length; - if(buf_size < context->length - (avctx->pix_fmt==PIX_FMT_PAL8 ? 256*4 : 0)) - return -1; - avpicture_fill(picture, buf, avctx->pix_fmt, avctx->width, avctx->height); if((avctx->pix_fmt==PIX_FMT_PAL8 && buf_size < context->length) || (avctx->pix_fmt!=PIX_FMT_PAL8 && |