diff options
| author | Ronald S. Bultje <rsbultje@gmail.com> | 2012-03-06 17:24:20 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-01 18:33:28 +0200 |
| commit | f2e412d050ae9a0dcdea515f1c02620c6dcf8c47 (patch) | |
| tree | d9cb676b735cacc79da204182d55745bde75bde0 | |
| parent | 6dfe865aed25b52b181afddd37e1622d34f57d0b (diff) | |
| download | ffmpeg-f2e412d050ae9a0dcdea515f1c02620c6dcf8c47.tar.gz | |
smacker: error out if palette copy-with-offset overruns palette size.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit a93b572ae4f517ce0c35cf085167c318e9215908)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
| -rw-r--r-- | libavformat/smacker.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libavformat/smacker.c b/libavformat/smacker.c index a817c31355..7ec8099376 100644 --- a/libavformat/smacker.c +++ b/libavformat/smacker.c @@ -261,8 +261,15 @@ static int smacker_read_packet(AVFormatContext *s, AVPacket *pkt) sz += (t & 0x7F) + 1; pal += ((t & 0x7F) + 1) * 3; } else if(t & 0x40){ /* copy with offset */ - off = avio_r8(s->pb) * 3; + off = avio_r8(s->pb); j = (t & 0x3F) + 1; + if (off + j > 0xff) { + av_log(s, AV_LOG_ERROR, + "Invalid palette update, offset=%d length=%d extends beyond palette size\n", + off, j); + return AVERROR_INVALIDDATA; + } + off *= 3; while(j-- && sz < 256) { *pal++ = oldpal[off + 0]; *pal++ = oldpal[off + 1]; |