highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/exr: Check tile positions

Browse Source 
This also disabled the case of mixed x/ymin with tiles, the code
handles these cases inconsistent for the 2 coordinate axis and is
unlikely working correctly.

Fixes crash
Fixes: poc1.exr, poc2.exr

Found-by: Yaoguang Chen of Aliapy unLimit Security Team
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 01aee8148d4fa439cce678a11f5110656c98de1f)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-08-17 21:22:29 +02:00
parent ae89381962
commit 79f52a0dbd
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavcodec/exr.c
View File

@ -1027,8 +1027,9 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
uint64_t line_offset, uncompressed_size;
uint16_t *ptr_x;
uint8_t *ptr;
uint32_t data_size, line, col = 0;
uint32_t tileX, tileY, tileLevelX, tileLevelY;
uint32_t data_size;
uint64_t line, col = 0;
uint64_t tileX, tileY, tileLevelX, tileLevelY;
const uint8_t *src;
int axmax = (avctx->width - (s->xmax + 1)) * 2 * s->desc->nb_components; /* nb pixel to add at the right of the datawindow */
int bxmin = s->xmin * 2 * s->desc->nb_components; /* nb pixel to add at the left of the datawindow */
@ -1059,9 +1060,18 @@ static int decode_block(AVCodecContext *avctx, void *tdata,
return AVERROR_PATCHWELCOME;
}
if (s->xmin || s->ymin) {
avpriv_report_missing_feature(s->avctx, "Tiles with xmin/ymin");
return AVERROR_PATCHWELCOME;
}
line = s->tile_attr.ySize * tileY;
col = s->tile_attr.xSize * tileX;
if (line < s->ymin || line > s->ymax ||
col < s->xmin || col > s->xmax)
return AVERROR_INVALIDDATA;
td->ysize = FFMIN(s->tile_attr.ySize, s->ydelta - tileY * s->tile_attr.ySize);
td->xsize = FFMIN(s->tile_attr.xSize, s->xdelta - tileX * s->tile_attr.xSize);