highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qpeg: fix overreads.

Browse Source 
qpeg should probably be changed to use the checked bytestream reader.
But for now this fixes it and is significantly less work.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2012-03-03 03:50:05 +01:00
parent 4299dfa5de
commit 81d4b3af81
1 changed files with 9 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
libavcodec/qpeg.c
View File

@ -143,7 +143,7 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
if(delta) { if(delta) {
/* motion compensation */ /* motion compensation */
while((code & 0xF0) == 0xF0) { while(size > 0 && (code & 0xF0) == 0xF0) {
if(delta == 1) { if(delta == 1) {
int me_idx; int me_idx;
int me_w, me_h, me_x, me_y; int me_w, me_h, me_x, me_y;
@ -210,6 +210,9 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
} else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */ } else if(code >= 0xC0) { /* copy code: 0xC0..0xDF */
code &= 0x1F; code &= 0x1F;
if(code + 1 > size)
break;
for(i = 0; i <= code; i++) { for(i = 0; i <= code; i++) {
dst[filled++] = *src++; dst[filled++] = *src++;
if(filled >= width) { if(filled >= width) {
@ -227,11 +230,11 @@ static void qpeg_decode_inter(const uint8_t *src, uint8_t *dst, int size,
code &= 0x3F; code &= 0x3F;
/* codes 0x80 and 0x81 are actually escape codes, /* codes 0x80 and 0x81 are actually escape codes,
skip value minus constant is in the next byte */ skip value minus constant is in the next byte */
if(!code) if(!code) {
skip = (*src++) + 64; skip = (*src++) + 64; size--;
else if(code == 1) } else if(code == 1) {
skip = (*src++) + 320; skip = (*src++) + 320; size--;
else } else
skip = code; skip = code;
filled += skip; filled += skip;
while( filled >= width) { while( filled >= width) {