xenia-project/FFmpeg
1
0
Fork 0
mirror of https://github.com/xenia-project/FFmpeg.git synced 2024-11-24 12:09:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

pcx: Do not overread source buffer in pcx_rle_decode

Browse Source 
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-06-29 06:37:32 +02:00
parent 170fb593c6
commit 3abde1a3b4
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libavcodec/pcx.c
View File

@ -31,7 +31,9 @@
/**
* @return advanced src pointer
*/
static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
static const uint8_t *pcx_rle_decode(const uint8_t *src,
const uint8_t *end,
uint8_t *dst,
unsigned int bytes_per_scanline,
int compressed)
{
@ -39,10 +41,10 @@ static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst,
unsigned char run, value;
if (compressed) {
while (i < bytes_per_scanline) {
while (i < bytes_per_scanline && src < end) {
run = 1;
value = *src++;
if (value >= 0xc0) {
if (value >= 0xc0 && src < end) {
run = value & 0x3f;
value = *src++;
}
@ -78,6 +80,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x,
bytes_per_scanline;
uint8_t *ptr;
const uint8_t *buf_end = buf + buf_size;
uint8_t const *bufstart = buf;
uint8_t *scanline;
int ret = -1;
@ -106,7 +109,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
nplanes = buf[65];
bytes_per_scanline = nplanes * bytes_per_line;
if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) {
if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 ||
(!compressed && bytes_per_scanline > buf_size / h)) {
av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n");
return AVERROR_INVALIDDATA;
}
@ -151,7 +155,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
if (nplanes == 3 && bits_per_pixel == 8) {
for (y = 0; y < h; y++) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++) {
ptr[3 * x] = scanline[x];
@ -165,7 +170,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
const uint8_t *palstart = bufstart + buf_size - 769;
for (y = 0; y < h; y++, ptr += stride) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
memcpy(ptr, scanline, w);
}
@ -183,7 +189,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
for (y = 0; y < h; y++) {
init_get_bits(&s, scanline, bytes_per_scanline << 3);
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++)
ptr[x] = get_bits(&s, bits_per_pixel);
@ -193,7 +200,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
int i;
for (y = 0; y < h; y++) {
buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed);
buf = pcx_rle_decode(buf, buf_end,
scanline, bytes_per_scanline, compressed);
for (x = 0; x < w; x++) {
int m = 0x80 >> (x & 7), v = 0;