diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-01-25 04:51:06 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-26 20:10:26 +0100 |
| commit | 88d84dd8eacd4edfe29f12209f10733d631ca5ae (patch) | |
| tree | 0741f8780b7f1c71b662d6ca811959c9c4ce2469 | |
| parent | 8847561f93c8e44095324a2c16ba78adf1a7511a (diff) | |
| download | ffmpeg-88d84dd8eacd4edfe29f12209f10733d631ca5ae.tar.gz | |
dv: Fix out of array read
Fixes part of CVE-2011-3936
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavformat/dv.c | 10 |
1 files changed, 6 insertions, 4 deletions
diff --git a/libavformat/dv.c b/libavformat/dv.c index 86ed1e954e..666e3317ab 100644 --- a/libavformat/dv.c +++ b/libavformat/dv.c @@ -35,6 +35,7 @@ #include "libavutil/intreadwrite.h" #include "libavutil/mathematics.h" #include "dv.h" +#include "libavutil/avassert.h" struct DVDemuxContext { const DVprofile* sys; /* Current DV profile. E.g.: 525/60, 625/50 */ @@ -130,15 +131,19 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4], /* We work with 720p frames split in half, thus even frames have * channels 0,1 and odd 2,3. */ ipcm = (sys->height == 720 && !(frame[1] & 0x0C)) ? 2 : 0; - pcm = ppcm[ipcm++]; /* for each DIF channel */ for (chan = 0; chan < sys->n_difchan; chan++) { + av_assert0(ipcm<4); + pcm = ppcm[ipcm++]; + if (!pcm) + break; /* for each DIF segment */ for (i = 0; i < sys->difseg_size; i++) { frame += 6 * 80; /* skip DIF segment header */ if (quant == 1 && i == half_ch) { /* next stereo channel (12bit mode only) */ + av_assert0(ipcm<4); pcm = ppcm[ipcm++]; if (!pcm) break; @@ -183,9 +188,6 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4], } /* next stereo channel (50Mbps and 100Mbps only) */ - pcm = ppcm[ipcm++]; - if (!pcm) - break; } return size; |