diff options
| author | Alex Converse <alex.converse@gmail.com> | 2012-01-26 15:08:26 -0800 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2012-04-21 15:41:57 +0200 |
| commit | 5a92aa378d066369c6d9a82192c274ae4b8997f0 (patch) | |
| tree | 5e14951c580b81a6ca26a6c92a2b3d8c3c6d76b4 /libavformat | |
| parent | c4e8c99507b0b4ad384bea061afb6025ca868174 (diff) | |
| download | ffmpeg-5a92aa378d066369c6d9a82192c274ae4b8997f0.tar.gz | |
dv: Fix small stack overread related to CVE-2011-3929 and CVE-2011-3936.
Found with asan.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Alex Converse <alex.converse@gmail.com>
(cherry picked from commit 2d1c0dea5f6b91bec7f5fa53ec050913d851e366)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit 00fa6ffe1a0b252d6a81815e51f125225cd0b97a)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit a8f4db0acd9b588ba33e3b8c0c21feea5916cfd1)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Diffstat (limited to 'libavformat')
| -rw-r--r-- | libavformat/dv.c | 11 |
1 files changed, 5 insertions, 6 deletions
diff --git a/libavformat/dv.c b/libavformat/dv.c index 54ed81854f..256dcd4312 100644 --- a/libavformat/dv.c +++ b/libavformat/dv.c @@ -125,10 +125,14 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4], /* We work with 720p frames split in half, thus even frames have * channels 0,1 and odd 2,3. */ ipcm = (sys->height == 720 && !(frame[1] & 0x0C)) ? 2 : 0; - pcm = ppcm[ipcm++]; /* for each DIF channel */ for (chan = 0; chan < sys->n_difchan; chan++) { + /* next stereo channel (50Mbps and 100Mbps only) */ + pcm = ppcm[ipcm++]; + if (!pcm) + break; + /* for each DIF segment */ for (i = 0; i < sys->difseg_size; i++) { frame += 6 * 80; /* skip DIF segment header */ @@ -176,11 +180,6 @@ static int dv_extract_audio(uint8_t* frame, uint8_t* ppcm[4], frame += 16 * 80; /* 15 Video DIFs + 1 Audio DIF */ } } - - /* next stereo channel (50Mbps and 100Mbps only) */ - pcm = ppcm[ipcm++]; - if (!pcm) - break; } return size; |