diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2021-05-29 09:22:27 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2021-09-09 13:54:52 +0200 |
| commit | 14e172600e65817144be48a774c9b699b9563653 (patch) | |
| tree | ff514bd5a945065e1fbe9a813838b6b33af24b5a /libavformat/movenc.c | |
| parent | 9dd54c28df57821b1afb81d00928ed9bba71c691 (diff) | |
| download | ffmpeg-14e172600e65817144be48a774c9b699b9563653.tar.gz | |
avformat/movenc: Check pal_size before use
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c1afa292520329eecd1cc7631bc59a8cca95c46)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/movenc.c')
| -rw-r--r-- | libavformat/movenc.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 1117781a28..5e58c74fb0 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -1988,11 +1988,13 @@ static int mov_write_video_tag(AVIOContext *pb, MOVMuxContext *mov, MOVTrack *tr avio_wb16(pb, 0x18); /* Reserved */ if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) { - int pal_size = 1 << track->par->bits_per_coded_sample; - int i; + int pal_size, i; avio_wb16(pb, 0); /* Color table ID */ avio_wb32(pb, 0); /* Color table seed */ avio_wb16(pb, 0x8000); /* Color table flags */ + if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8) + return AVERROR(EINVAL); + pal_size = 1 << track->par->bits_per_coded_sample; avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */ for (i = 0; i < pal_size; i++) { uint32_t rgb = track->palette[i]; |