aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/hevc.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michael@niedermayer.cc>2015-11-27 18:30:05 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2015-11-27 18:53:21 +0100
commitef9f7bbfa47317f9d46bf46982a394d2be78503c (patch)
tree77b68b88b81315595f02a037bb1bc080cff0a741 /libavcodec/hevc.c
parentec0719264cb9a9d5cbaf225da48929aea24997a3 (diff)
downloadffmpeg-ef9f7bbfa47317f9d46bf46982a394d2be78503c.tar.gz
avcodec/hevc: Check entry_point_offsets
Fixes out of array read Fixes: 007c4a36608ebdf27ee260ad60a81184/asan_heap-oob_32076b4_2243_116b1cb29d91cc4974d6680e3d10bd91.bit Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/hevc.c')
-rw-r--r--libavcodec/hevc.c8
1 files changed, 7 insertions, 1 deletions
diff --git a/libavcodec/hevc.c b/libavcodec/hevc.c
index ece36f8eb0..e9f27a4bea 100644
--- a/libavcodec/hevc.c
+++ b/libavcodec/hevc.c
@@ -2442,7 +2442,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
HEVCLocalContext *lc = s->HEVClc;
int *ret = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
int *arg = av_malloc_array(s->sh.num_entry_point_offsets + 1, sizeof(int));
- int offset;
+ int64_t offset;
int startheader, cmpt = 0;
int i, j, res = 0;
@@ -2489,6 +2489,11 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
}
if (s->sh.num_entry_point_offsets != 0) {
offset += s->sh.entry_point_offset[s->sh.num_entry_point_offsets - 1] - cmpt;
+ if (length < offset) {
+ av_log(s->avctx, AV_LOG_ERROR, "entry_point_offset table is corrupted\n");
+ res = AVERROR_INVALIDDATA;
+ goto error;
+ }
s->sh.size[s->sh.num_entry_point_offsets - 1] = length - offset;
s->sh.offset[s->sh.num_entry_point_offsets - 1] = offset;
@@ -2515,6 +2520,7 @@ static int hls_slice_data_wpp(HEVCContext *s, const HEVCNAL *nal)
for (i = 0; i <= s->sh.num_entry_point_offsets; i++)
res += ret[i];
+error:
av_free(ret);
av_free(arg);
return res;