From c871244306f92fecaaed8a97f47ba54d46eb0cd5 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 11 Nov 2012 20:51:30 +0100 Subject: [PATCH] proresdec: check input size before reading qmats, prevent overreading. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer --- libavcodec/proresdec2.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/libavcodec/proresdec2.c b/libavcodec/proresdec2.c index d14b535211..e643c87ade 100644 --- a/libavcodec/proresdec2.c +++ b/libavcodec/proresdec2.c @@ -133,6 +133,10 @@ static int decode_frame_header(ProresContext *ctx, const uint8_t *buf, av_dlog(avctx, "flags %x\n", flags); if (flags & 2) { + if(buf + data_size - ptr < 64) { + av_log(avctx, AV_LOG_ERROR, "Header truncated\n"); + return -1; + } permute(ctx->qmat_luma, ctx->prodsp.idct_permutation, ptr); ptr += 64; } else { @@ -140,6 +144,10 @@ static int decode_frame_header(ProresContext *ctx, const uint8_t *buf, } if (flags & 1) { + if(buf + data_size - ptr < 64) { + av_log(avctx, AV_LOG_ERROR, "Header truncated\n"); + return -1; + } permute(ctx->qmat_chroma, ctx->prodsp.idct_permutation, ptr); } else { memset(ctx->qmat_chroma, 4, 64);