From ff1e30c059386db05131fe2f5bca1f35e1f5ac7e Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Thu, 19 Dec 2013 00:17:12 +0100 Subject: [PATCH] avcodec/interplayvideo: Check that enough data is available for opcode_0xA Fixes use of uninitialized memory Fixes: msan_uninit-mem_7f90e5be6b30_3965_baldursgate_camp.mve Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/interplayvideo.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c index 7ac1456954..71f89ab920 100644 --- a/libavcodec/interplayvideo.c +++ b/libavcodec/interplayvideo.c @@ -374,6 +374,11 @@ static int ipvideo_decode_block_opcode_0xA(IpvideoContext *s, AVFrame *frame) unsigned char P[8]; int flags = 0; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 16) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0xA\n"); + return AVERROR_INVALIDDATA; + } + bytestream2_get_buffer(&s->stream_ptr, P, 4); /* 4-color encoding for each 4x4 quadrant, or 4-color encoding on