har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

rv34: Check for invalid slices offsets

Browse Source 
Signed-off-by: Martin Storsjö <martin@martin.st>
This commit is contained in:
Laurent Aimar 2011-09-21 20:46:31 +02:00 committed by Martin Storsjö
parent 775af761a0
commit fe476e5a9b
1 changed files with 10 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/rv34.c
View File

@ -1513,13 +1513,18 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
else else
size = get_slice_offset(avctx, slices_hdr, i+1) - offset; size = get_slice_offset(avctx, slices_hdr, i+1) - offset;
if(offset < 0 || offset > buf_size || size < 0){ if(offset < 0 || offset > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n"); av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break; break;
} }
r->si.end = s->mb_width * s->mb_height; r->si.end = s->mb_width * s->mb_height;
if(i+1 < slice_count){ if(i+1 < slice_count){
if (get_slice_offset(avctx, slices_hdr, i+1) < 0 ||
get_slice_offset(avctx, slices_hdr, i+1) > buf_size) {
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break;
}
init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, i+1), (buf_size-get_slice_offset(avctx, slices_hdr, i+1))*8); init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, i+1), (buf_size-get_slice_offset(avctx, slices_hdr, i+1))*8);
if(r->parse_slice_header(r, &r->s.gb, &si) < 0){ if(r->parse_slice_header(r, &r->s.gb, &si) < 0){
if(i+2 < slice_count) if(i+2 < slice_count)
@ -1529,6 +1534,10 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
}else }else
r->si.end = si.start; r->si.end = si.start;
} }
if (size < 0 || size > buf_size - offset) {
av_log(avctx, AV_LOG_ERROR, "Slice size is invalid\n");
break;
}
last = rv34_decode_slice(r, r->si.end, buf + offset, size); last = rv34_decode_slice(r, r->si.end, buf + offset, size);
s->mb_num_left = r->s.mb_x + r->s.mb_y*r->s.mb_width - r->si.start; s->mb_num_left = r->s.mb_x + r->s.mb_y*r->s.mb_width - r->si.start;
if(last) if(last)