diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-05-12 00:43:48 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-05-19 22:14:39 +0200 |
| commit | e35fe3d8b9e345527a05b1ae958ac851fe09f1ed (patch) | |
| tree | 188ecabbf34c5e059b9ce4a8d3d99958eba90e31 /libavcodec/mscc.c | |
| parent | b6b2b01025e016ce29e5add57305384a663edcfc (diff) | |
| download | ffmpeg-e35fe3d8b9e345527a05b1ae958ac851fe09f1ed.tar.gz | |
avcodec/mscc & mwsc: Check loop counts before use
This could cause timeouts
Fixes: CID1439568 Untrusted loop bound
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec/mscc.c')
| -rw-r--r-- | libavcodec/mscc.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mscc.c b/libavcodec/mscc.c index 26143bfd5e..2d6f6265bf 100644 --- a/libavcodec/mscc.c +++ b/libavcodec/mscc.c @@ -54,6 +54,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont unsigned run = bytestream2_get_byte(gb); if (run) { + if (bytestream2_get_bytes_left_p(pb) < run * s->bpp) + return AVERROR_INVALIDDATA; + switch (avctx->bits_per_coded_sample) { case 8: fill = bytestream2_get_byte(gb); @@ -102,6 +105,9 @@ static int rle_uncompress(AVCodecContext *avctx, GetByteContext *gb, PutByteCont bytestream2_seek_p(pb, y * avctx->width * s->bpp + x * s->bpp, SEEK_SET); } else { + if (bytestream2_get_bytes_left_p(pb) < copy * s->bpp) + return AVERROR_INVALIDDATA; + for (j = 0; j < copy; j++) { switch (avctx->bits_per_coded_sample) { case 8: |