aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/indeo5.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2012-04-15 14:11:50 +0200
committerAnton Khirnov <anton@khirnov.net>2012-09-29 19:12:36 +0200
commit2d09cdbaf2f449ba23d54e97e94bd97ca22208c6 (patch)
treec9c854ae67e0870631357bf8b50a862e92cf474e /libavcodec/indeo5.c
parente4d4044339b9c3b0f45f7203cd026eda3c0414c0 (diff)
downloadffmpeg-2d09cdbaf2f449ba23d54e97e94bd97ca22208c6.tar.gz
indeo5: check tile size in decode_mb_info().
This prevents writing into a too small array if some parameters changed without the tile being reallocated. Fixes CVE-2012-2794 CC:libav-stable@libav.org Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Anton Khirnov <anton@khirnov.net>
Diffstat (limited to 'libavcodec/indeo5.c')
-rw-r--r--libavcodec/indeo5.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c
index 4f8e0d8e96..4044a04ba2 100644
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -430,6 +430,12 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band,
((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv))
return AVERROR_INVALIDDATA;
+ if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
+ av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches parameters %d\n",
+ tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+ return AVERROR_INVALIDDATA;
+ }
+
/* scale factor for motion vectors */
mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
mv_x = mv_y = 0;