diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-14 17:59:56 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2015-11-14 18:26:11 +0100 |
| commit | ac6ab77741f5e57c8c1d3980bfaf3690eb1cd8c0 (patch) | |
| tree | 3928ca99a547f2c053f0bb178e5bd4386372c09e | |
| parent | 618b3ae7d4a90a0b4a25995bf54896cdee129a5b (diff) | |
| download | ffmpeg-ac6ab77741f5e57c8c1d3980bfaf3690eb1cd8c0.tar.gz | |
avcodec/rscc: Check input size for raw mode
Fixes out of array read
Fixes: 7fcd09eadd046e326d8ea0af66f166c8/asan_heap-oob_4a52e5_2273_fa6078a10dd575df266fb1e0b4114cd5.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/rscc.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/rscc.c b/libavcodec/rscc.c index 9e7887da9a..a5bb7d3102 100644 --- a/libavcodec/rscc.c +++ b/libavcodec/rscc.c @@ -221,6 +221,11 @@ static int rscc_decode_frame(AVCodecContext *avctx, void *data, /* Get pixels buffer, it may be deflated or just raw */ if (pixel_size == packed_size) { + if (bytestream2_get_bytes_left(gbc) < pixel_size) { + av_log(avctx, AV_LOG_ERROR, "Insufficient input for %d\n", pixel_size); + ret = AVERROR_INVALIDDATA; + goto end; + } pixels = gbc->buffer; } else { uLongf len = ctx->inflated_size; |