aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2021-05-29 09:22:27 +0200
committerMichael Niedermayer <michael@niedermayer.cc>2021-06-18 20:53:56 +0200
commit5f9f6894970b1c3e4157e695b9d1d7cd08f04be2 (patch)
tree6f167f2781fb36b9b303f0f12baba84a7ddb42f2
parent7fbea837fd8584536ba3f4d73e639d84ae6359a1 (diff)
downloadffmpeg-5f9f6894970b1c3e4157e695b9d1d7cd08f04be2.tar.gz
avformat/movenc: Check pal_size before use
Fixes: assertion failure Fixes: out of array read Fixes: Ticket8190 Fixes: CVE-2020-22015 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> (cherry picked from commit 4c1afa292520329eecd1cc7631bc59a8cca95c46) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
-rw-r--r--libavformat/movenc.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
index bd1e795a65..2cd5773dc5 100644
--- a/libavformat/movenc.c
+++ b/libavformat/movenc.c
@@ -2177,11 +2177,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex
avio_wb16(pb, 0x18); /* Reserved */
if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) {
- int pal_size = 1 << track->par->bits_per_coded_sample;
- int i;
+ int pal_size, i;
avio_wb16(pb, 0); /* Color table ID */
avio_wb32(pb, 0); /* Color table seed */
avio_wb16(pb, 0x8000); /* Color table flags */
+ if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8)
+ return AVERROR(EINVAL);
+ pal_size = 1 << track->par->bits_per_coded_sample;
avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */
for (i = 0; i < pal_size; i++) {
uint32_t rgb = track->palette[i];