aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2015-11-11 00:20:18 +0100
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2015-11-11 21:49:51 +0100
commit9a37d476440d9edaa26e6ed946d79cedde9d9e93 (patch)
tree77703b5a87c40a77348b84f64f08a6df54a6fab8
parent1675809d2df76b1a185c78ca0a7a1c8ccb493167 (diff)
downloadffmpeg-9a37d476440d9edaa26e6ed946d79cedde9d9e93.tar.gz
dds: validate compressed source buffer size
A too small buffer will cause segfaults somewhere below decompress_texture_thread. Reviewed-by: Vittorio Giovara <vittorio.giovara@gmail.com> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
-rw-r--r--libavcodec/dds.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/libavcodec/dds.c b/libavcodec/dds.c
index 324e6657a6..c918cf0fa5 100644
--- a/libavcodec/dds.c
+++ b/libavcodec/dds.c
@@ -642,9 +642,18 @@ static int dds_decode(AVCodecContext *avctx, void *data,
return ret;
if (ctx->compressed) {
+ int size = (avctx->coded_height / TEXTURE_BLOCK_H) *
+ (avctx->coded_width / TEXTURE_BLOCK_W) * ctx->tex_ratio;
ctx->slice_count = av_clip(avctx->thread_count, 1,
avctx->coded_height / TEXTURE_BLOCK_H);
+ if (bytestream2_get_bytes_left(gbc) < size) {
+ av_log(avctx, AV_LOG_ERROR,
+ "Compressed Buffer is too small (%d < %d).\n",
+ bytestream2_get_bytes_left(gbc), size);
+ return AVERROR_INVALIDDATA;
+ }
+
/* Use the decompress function on the texture, one block per thread. */
ctx->tex_data = gbc->buffer;
avctx->execute2(avctx, decompress_texture_thread, frame, NULL, ctx->slice_count);