xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2024-11-24 12:09:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

xan: check size_segment before reading, fixes out of array read.

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-12 20:42:33 +01:00
parent a9456c7c5c
commit 0e239b22db
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/xan.c
View File

@ -359,17 +359,29 @@ static int xan_wc3_decode_frame(XanContext *s) {
case 9: case 9:
case 19: case 19:
if (buf_end - size_segment < 1) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = *size_segment++; size = *size_segment++;
break; break;
case 10: case 10:
case 20: case 20:
if (buf_end - size_segment < 2) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = AV_RB16(&size_segment[0]); size = AV_RB16(&size_segment[0]);
size_segment += 2; size_segment += 2;
break; break;
case 11: case 11:
case 21: case 21:
if (buf_end - size_segment < 3) {
av_log(s->avctx, AV_LOG_ERROR, "size_segment overread\n");
return AVERROR_INVALIDDATA;
}
size = AV_RB24(size_segment); size = AV_RB24(size_segment);
size_segment += 3; size_segment += 3;
break; break;