diff options
| author | Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> | 2015-03-05 22:48:28 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-29 03:28:38 +0200 |
| commit | 53fa0d370cbbf7605687a2d3c669f7f015136931 (patch) | |
| tree | e8d6e4b9bd853646f86e2d12bd53d3cb65de9b21 /libavcodec/webp.c | |
| parent | 8e7eb268758dcb37a4452d02e8908ebf709e21e2 (diff) | |
| download | ffmpeg-53fa0d370cbbf7605687a2d3c669f7f015136931.tar.gz | |
webp: ensure that each transform is only used once
According to the WebP Lossless Bitstream Specification
"each transform is allowed to be used only once".
If a transform is more than once this can lead to memory
corruption.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit c089e720c1b753790c746a13053636d7facf6bf0)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/webp.c')
| -rw-r--r-- | libavcodec/webp.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/libavcodec/webp.c b/libavcodec/webp.c index 31c5bd9ca8..c92539fd93 100644 --- a/libavcodec/webp.c +++ b/libavcodec/webp.c @@ -1087,7 +1087,7 @@ static int vp8_lossless_decode_frame(AVCodecContext *avctx, AVFrame *p, unsigned int data_size, int is_alpha_chunk) { WebPContext *s = avctx->priv_data; - int w, h, ret, i; + int w, h, ret, i, used; if (!is_alpha_chunk) { s->lossless = 1; @@ -1137,8 +1137,16 @@ static int vp8_lossless_decode_frame(AVCodecContext *avctx, AVFrame *p, /* parse transformations */ s->nb_transforms = 0; s->reduced_width = 0; + used = 0; while (get_bits1(&s->gb)) { enum TransformType transform = get_bits(&s->gb, 2); + if (used & (1 << transform)) { + av_log(avctx, AV_LOG_ERROR, "Transform %d used more than once\n", + transform); + ret = AVERROR_INVALIDDATA; + goto free_and_return; + } + used |= (1 << transform); s->transforms[s->nb_transforms++] = transform; switch (transform) { case PREDICTOR_TRANSFORM: |