highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sanm: Use the correct height variable in the decoded_size checks

Browse Source 
Fixes integer overflow and out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-02-12 02:03:28 +01:00
parent 4ee88db840
commit 5260edee7e
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/sanm.c
View File

@ -420,8 +420,8 @@ static int old_codec37(SANMVideoContext *ctx, int top,
flags = bytestream2_get_byte(&ctx->gb); flags = bytestream2_get_byte(&ctx->gb);
bytestream2_skip(&ctx->gb, 3); bytestream2_skip(&ctx->gb, 3);
if (decoded_size > height * stride - left - top * stride) { if (decoded_size > ctx->height * stride - left - top * stride) {
decoded_size = height * stride - left - top * stride; decoded_size = ctx->height * stride - left - top * stride;
av_log(ctx->avctx, AV_LOG_WARNING, "decoded size is too large\n"); av_log(ctx->avctx, AV_LOG_WARNING, "decoded size is too large\n");
} }
@ -658,8 +658,8 @@ static int old_codec47(SANMVideoContext *ctx, int top,
decoded_size = bytestream2_get_le32(&ctx->gb); decoded_size = bytestream2_get_le32(&ctx->gb);
bytestream2_skip(&ctx->gb, 8); bytestream2_skip(&ctx->gb, 8);
if (decoded_size > height * stride - left - top * stride) { if (decoded_size > ctx->height * stride - left - top * stride) {
decoded_size = height * stride - left - top * stride; decoded_size = ctx->height * stride - left - top * stride;
av_log(ctx->avctx, AV_LOG_WARNING, "decoded size is too large\n"); av_log(ctx->avctx, AV_LOG_WARNING, "decoded size is too large\n");
} }