diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-15 14:11:50 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-10-14 16:03:24 -0400 |
| commit | 5c413648c1483385b74394fa40ded8e35b9ea4a2 (patch) | |
| tree | 515d18ccba0be4f1065c7c1cb9f6cb5d0fc26731 /libavcodec | |
| parent | 3efe6becc79b8087ea517b12380f34b702db1cc5 (diff) | |
| download | ffmpeg-5c413648c1483385b74394fa40ded8e35b9ea4a2.tar.gz | |
indeo5: check tile size in decode_mb_info().
This prevents writing into a too small array if some parameters changed
without the tile being reallocated.
Fixes CVE-2012-2794
CC:libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2d09cdbaf2f449ba23d54e97e94bd97ca22208c6)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/indeo5.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c index a8ff228bcd..987b1a319f 100644 --- a/libavcodec/indeo5.c +++ b/libavcodec/indeo5.c @@ -430,6 +430,12 @@ static int decode_mb_info(IVI45DecContext *ctx, IVIBandDesc *band, ((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv)) return AVERROR_INVALIDDATA; + if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) { + av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches parameters %d\n", + tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)); + return AVERROR_INVALIDDATA; + } + /* scale factor for motion vectors */ mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); mv_x = mv_y = 0; |