diff options
| author | Steinar H. Gunderson <steinar+ffmpeg@gunderson.no> | 2017-02-01 17:19:18 +0100 |
|---|---|---|
| committer | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2017-02-02 01:12:07 +0100 |
| commit | 08b098169be079c4f124a351fda6764fbcd10e79 (patch) | |
| tree | d990582c4339f2bc1c3892c8f0710e3be139a395 /cmdutils_opencl.c | |
| parent | 4c2176d45be1a7fbbcdf1f3d01b1ba2bab6f8d0f (diff) | |
| download | ffmpeg-08b098169be079c4f124a351fda6764fbcd10e79.tar.gz | |
speedhq: fix out-of-bounds write
Certain alpha run lengths (for SHQ1/SHQ3/SHQ5) could be stored in
both long and short versions, and we would only accept the short version,
returning -1 (invalid code) for the others. This could cause an
out-of-bounds write on malicious input, as discovered by
Andreas Cadhalpun during fuzzing.
Fix by simply allowing both versions, leaving no invalid codes
in the alpha VLC.
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Diffstat (limited to 'cmdutils_opencl.c')
0 files changed, 0 insertions, 0 deletions