xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2025-03-03 17:48:16 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

tm2: check for invalid vlcs, fix out of array read

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-17 01:09:20 +01:00
parent c6945228e8
commit 31fce39942
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/truemotion2.c
View File

@ -200,6 +200,8 @@ static inline int tm2_get_token(GetBitContext *gb, TM2Codes *code)
{ {
int val; int val;
val = get_vlc2(gb, code->vlc.table, code->bits, 1); val = get_vlc2(gb, code->vlc.table, code->bits, 1);
if(val<0)
return -1;
return code->recode[val]; return code->recode[val];
} }
@ -325,7 +327,7 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, i
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
ctx->tokens[stream_id][i] = tm2_get_token(&ctx->gb, &codes); ctx->tokens[stream_id][i] = tm2_get_token(&ctx->gb, &codes);
if (stream_id <= TM2_MOT && ctx->tokens[stream_id][i] >= TM2_DELTAS) { if (stream_id <= TM2_MOT && ctx->tokens[stream_id][i] >= TM2_DELTAS || ctx->tokens[stream_id][i]<0) {
av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n", av_log(ctx->avctx, AV_LOG_ERROR, "Invalid delta token index %d for type %d, n=%d\n",
ctx->tokens[stream_id][i], stream_id, i); ctx->tokens[stream_id][i], stream_id, i);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;