har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

pcx: Check the packet size before assuming it fits a palette

Browse Source 
This fixes reads out of bounds.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Signed-off-by: Martin Storsjö <martin@martin.st>
This commit is contained in:
Martin Storsjö 2013-09-29 13:02:27 +03:00
parent 7ba0cedbfe
commit d1d99e3bef
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/pcx.c
View File

@ -169,6 +169,12 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
} else if (nplanes == 1 && bits_per_pixel == 8) { } else if (nplanes == 1 && bits_per_pixel == 8) {
const uint8_t *palstart = bufstart + buf_size - 769; const uint8_t *palstart = bufstart + buf_size - 769;
if (buf_size < 769) {
av_log(avctx, AV_LOG_ERROR, "File is too short\n");
ret = buf_size;
goto end;
}
for (y = 0; y < h; y++, ptr += stride) { for (y = 0; y < h; y++, ptr += stride) {
buf = pcx_rle_decode(buf, buf_end, buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed); scanline, bytes_per_scanline, compressed);