aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat
diff options
context:
space:
mode:
authorAlex Converse <alex.converse@gmail.com>2012-01-26 15:08:26 -0800
committerAlex Converse <alex.converse@gmail.com>2012-01-31 18:32:13 -0800
commit2d1c0dea5f6b91bec7f5fa53ec050913d851e366 (patch)
treea399f3e0542882964c606d3dc5ebb92a74edcef7 /libavformat
parent5a396bb3a66a61a68b80f2369d0249729bf85e04 (diff)
downloadffmpeg-2d1c0dea5f6b91bec7f5fa53ec050913d851e366.tar.gz
dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
Found with asan. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Alex Converse <alex.converse@gmail.com>
Diffstat (limited to 'libavformat')
-rw-r--r--libavformat/dv.c11
1 files changed, 5 insertions, 6 deletions
diff --git a/libavformat/dv.c b/libavformat/dv.c
index 5e1c798586..5be6118a7a 100644
--- a/libavformat/dv.c
+++ b/libavformat/dv.c
@@ -127,10 +127,14 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
/* We work with 720p frames split in half, thus even frames have
* channels 0,1 and odd 2,3. */
ipcm = (sys->height == 720 && !(frame[1] & 0x0C)) ? 2 : 0;
- pcm = ppcm[ipcm++];
/* for each DIF channel */
for (chan = 0; chan < sys->n_difchan; chan++) {
+ /* next stereo channel (50Mbps and 100Mbps only) */
+ pcm = ppcm[ipcm++];
+ if (!pcm)
+ break;
+
/* for each DIF segment */
for (i = 0; i < sys->difseg_size; i++) {
frame += 6 * 80; /* skip DIF segment header */
@@ -178,11 +182,6 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4],
frame += 16 * 80; /* 15 Video DIFs + 1 Audio DIF */
}
}
-
- /* next stereo channel (50Mbps and 100Mbps only) */
- pcm = ppcm[ipcm++];
- if (!pcm)
- break;
}
return size;