har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

indeo4: more complete check for the scan vs block sizes.

Browse Source 
Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-12 21:50:20 +01:00
parent 7581ad24a9
commit 7ab690bf5f
2 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/indeo4.c
View File

@ -365,6 +365,7 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
return AVERROR_INVALIDDATA;
}
band->scan = scan_index_to_tab[scan_indx];
band->scan_size = band->blk_size;
quant_mat = get_bits(&ctx->gb, 5);
if (quant_mat == 31) {
@ -382,6 +383,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band,
band->quant_mat = 0;
return AVERROR_INVALIDDATA;
}
if (band->scan_size != band->blk_size) {
av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n");
return AVERROR_INVALIDDATA;
}
/* decode block huffman codebook */
if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF,
&band->blk_vlc, avctx))

1
libavcodec/ivi_common.h
View File

@ -152,6 +152,7 @@ typedef struct IVIBandDesc {
int quant_mat; ///< dequant matrix index
int glob_quant; ///< quant base for this band
const uint8_t *scan; ///< ptr to the scan pattern
int scan_size; ///< size of the scantable
IVIHuffTab blk_vlc; ///< vlc table for decoding block data