diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-06 17:24:20 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-03-13 23:12:00 +0100 |
| commit | c3bf08d04cdec3d4fd5c4ea70e14b5edca2c45a7 (patch) | |
| tree | 1460f7150e2c026fe5970b268c49039c1b51d733 | |
| parent | 12247a13e018d64ba59012283d9b16374358985b (diff) | |
| download | ffmpeg-c3bf08d04cdec3d4fd5c4ea70e14b5edca2c45a7.tar.gz | |
smacker: error out if palette copy-with-offset overruns palette size.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a93b572ae4f517ce0c35cf085167c318e9215908)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavformat/smacker.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavformat/smacker.c b/libavformat/smacker.c index 770f5364d3..6df8b8b619 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -265,8 +265,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) sz += (t & 0x7F) + 1; pal += ((t & 0x7F) + 1) * 3; } else if(t & 0x40){ /* copy with offset */ - off = avio_r8(s->pb) * 3; + off = avio_r8(s->pb); j = (t & 0x3F) + 1; + if (off + j > 0xff) { + av_log(s, AV_LOG_ERROR, + "Invalid palette update, offset=%d length=%d extends beyond palette size\n", + off, j); + return AVERROR_INVALIDDATA; + } + off *= 3; while(j-- && sz < 256) { *pal++ = oldpal[off + 0]; *pal++ = oldpal[off + 1]; |