diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 21:55:13 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-11-22 22:31:46 +0100 |
| commit | 78446f0d9d6a57f6f58e4c0f00cc30ecff205046 (patch) | |
| tree | 9f2cc44a62577d1c65523ebb8345fd3b047a83d1 /libavcodec | |
| parent | 5a08ba5381cf8d46034440163e71cd95748beceb (diff) | |
| download | ffmpeg-78446f0d9d6a57f6f58e4c0f00cc30ecff205046.tar.gz | |
avcodec/hnm4video: fix write offset checks in decode_interframe_v4()
Fixes: asan_heap-oob_e76a51_1244_CASSE.HNM
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/hnm4video.c | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/libavcodec/hnm4video.c b/libavcodec/hnm4video.c index 5979926fb4..b3cf8ef199 100644 --- a/libavcodec/hnm4video.c +++ b/libavcodec/hnm4video.c @@ -157,7 +157,12 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s if (count == 0) { tag = bytestream2_get_byte(&gb) & 0xE0; tag = tag >> 5; + if (tag == 0) { + if (writeoffset + 2 > hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } hnm->current[writeoffset++] = bytestream2_get_byte(&gb); hnm->current[writeoffset++] = bytestream2_get_byte(&gb); } else if (tag == 1) { @@ -168,6 +173,10 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s writeoffset += count; } else if (tag == 3) { count = bytestream2_get_byte(&gb) * 2; + if (writeoffset + count > hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } while (count > 0) { hnm->current[writeoffset++] = bytestream2_peek_byte(&gb); count--; @@ -176,6 +185,10 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s } else { break; } + if (writeoffset > hnm->width * hnm->height) { + av_log(avctx, AV_LOG_ERROR, "writeoffset out of bounds\n"); + break; + } } else { previous = bytestream2_peek_byte(&gb) & 0x20; backline = bytestream2_peek_byte(&gb) & 0x40; @@ -194,7 +207,7 @@ static void decode_interframe_v4(AVCodecContext *avctx, uint8_t *src, uint32_t s } else if (backward && offset + 1 >= hnm->width * hnm->height) { av_log(avctx, AV_LOG_ERROR, "Attempting to read out of bounds"); break; - } else if (writeoffset + count >= hnm->width * hnm->height) { + } else if (writeoffset + 2*count > hnm->width * hnm->height) { av_log(avctx, AV_LOG_ERROR, "Attempting to write out of bounds"); break; |