highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

smacker: limit recursion depth of smacker_decode_bigtree

Browse Source 
This fixes segmentation faults due to stack-overflow caused by too deep
recursion.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 946ecd19ea752399bccc751c9339ff74b815587e)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
This commit is contained in:
Andreas Cadhalpun 2016-11-19 14:21:11 +01:00
parent 1c282152c1
commit 48d24cca13
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/smacker.c
View File

@ -131,8 +131,12 @@ static int smacker_decode_tree(GetBitContext *gb, HuffContext *hc, uint32_t pref
/** /**
* Decode header tree * Decode header tree
*/ */
static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx) static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx, int length)
{ {
if(length > 500) { // Larger length can cause segmentation faults due to too deep recursion.
av_log(NULL, AV_LOG_ERROR, "length too long\n");
return AVERROR_INVALIDDATA;
}
if (hc->current + 1 >= hc->length) { if (hc->current + 1 >= hc->length) {
av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n"); av_log(NULL, AV_LOG_ERROR, "Tree size exceeded!\n");
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
@ -161,12 +165,12 @@ static int smacker_decode_bigtree(GetBitContext *gb, HuffContext *hc, DBCtx *ctx
int r = 0, r_new, t; int r = 0, r_new, t;
t = hc->current++; t = hc->current++;
r = smacker_decode_bigtree(gb, hc, ctx); r = smacker_decode_bigtree(gb, hc, ctx, length + 1);
if(r < 0) if(r < 0)
return r; return r;
hc->values[t] = SMK_NODE | r; hc->values[t] = SMK_NODE | r;
r++; r++;
r_new = smacker_decode_bigtree(gb, hc, ctx); r_new = smacker_decode_bigtree(gb, hc, ctx, length + 1);
if (r_new < 0) if (r_new < 0)
return r_new; return r_new;
return r + r_new; return r + r_new;
@ -277,7 +281,7 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int
goto error; goto error;
} }
if (smacker_decode_bigtree(gb, &huff, &ctx) < 0) if (smacker_decode_bigtree(gb, &huff, &ctx, 0) < 0)
err = -1; err = -1;
skip_bits1(gb); skip_bits1(gb);
if(ctx.last[0] == -1) ctx.last[0] = huff.current++; if(ctx.last[0] == -1) ctx.last[0] = huff.current++;