diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 00:17:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 00:38:11 +0100 |
| commit | ff1e30c059386db05131fe2f5bca1f35e1f5ac7e (patch) | |
| tree | 40061726e5ae413a5b2d97ab39645dd161e06a46 /libavcodec | |
| parent | 4e575adeff316b351bc777a24d4b6beb5ac58cb2 (diff) | |
| download | ffmpeg-ff1e30c059386db05131fe2f5bca1f35e1f5ac7e.tar.gz | |
avcodec/interplayvideo: Check that enough data is available for opcode_0xA
Fixes use of uninitialized memory
Fixes: msan_uninit-mem_7f90e5be6b30_3965_baldursgate_camp.mve
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/interplayvideo.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c index 7ac1456954..71f89ab920 100644 --- a/libavcodec/interplayvideo.c +++ b/libavcodec/interplayvideo.c @@ -374,6 +374,11 @@ static int ipvideo_decode_block_opcode_0xA(IpvideoContext *s, AVFrame *frame) unsigned char P[8]; int flags = 0; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 16) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0xA\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_get_buffer(&s->stream_ptr, P, 4); /* 4-color encoding for each 4x4 quadrant, or 4-color encoding on |