diff options
| author | maryam ebr <me22bee@outlook.com> | 2021-08-03 01:05:47 -0400 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-10-17 21:34:53 +0200 |
| commit | c7b205dedd05a4983ab3ce557fdb06aa886127c9 (patch) | |
| tree | 27c177bccd5313fedb185c89b2c8259ba2e96506 | |
| parent | 764de1f6d8ff50d4d22f08fdff62cb0655900f15 (diff) | |
| download | ffmpeg-c7b205dedd05a4983ab3ce557fdb06aa886127c9.tar.gz | |
avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed.
crafted DNxHD data can cause unspecified impact.
Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: James Almer <jamrial@gmail.com>
(cherry picked from commit 7150f9575671f898382c370acae35f9087a30ba1)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
| -rw-r--r-- | libavcodec/dnxhddec.c | 22 |
1 files changed, 15 insertions, 7 deletions
diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c index 4a42360388..b930453cd8 100644 --- a/libavcodec/dnxhddec.c +++ b/libavcodec/dnxhddec.c @@ -78,6 +78,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx) static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid) { + int ret; if (cid != ctx->cid) { int index; @@ -96,21 +97,28 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid) ff_free_vlc(&ctx->dc_vlc); ff_free_vlc(&ctx->run_vlc); - init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, + if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, ctx->cid_table->ac_bits, 1, 1, - ctx->cid_table->ac_codes, 2, 2, 0); - init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, ctx->bit_depth + 4, + ctx->cid_table->ac_codes, 2, 2, 0)) < 0) + goto out; + if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, ctx->bit_depth + 4, ctx->cid_table->dc_bits, 1, 1, - ctx->cid_table->dc_codes, 1, 1, 0); - init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, + ctx->cid_table->dc_codes, 1, 1, 0)) < 0) + goto out; + if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, ctx->cid_table->run_bits, 1, 1, - ctx->cid_table->run_codes, 2, 2, 0); + ctx->cid_table->run_codes, 2, 2, 0)) < 0) + goto out; ff_init_scantable(ctx->idsp.idct_permutation, &ctx->scantable, ff_zigzag_direct); ctx->cid = cid; } - return 0; + ret = 0; +out: + if (ret < 0) + av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n"); + return ret; } static int dnxhd_decode_header(DNXHDContext *ctx, AVFrame *frame, |