highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

truemotion1: make sure index does not go out of bounds

Browse Source 
Fixes invalid reads.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC:libav-stable@libav.org
This commit is contained in:
Anton Khirnov
2013-11-15 19:06:23 +01:00
parent ce9bba5340
commit c918e08b9c
1 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/truemotion1.c
View File

@@ -515,6 +515,15 @@ hres,vres,i,i%vres (0 < i < 4)
index = s->index_stream[index_stream_index++] * 4; \ index = s->index_stream[index_stream_index++] * 4; \
} }
#define INC_INDEX \
do { \
if (index >= 1023) { \
av_log(s->avctx, AV_LOG_ERROR, "Invalid index value.\n"); \
return; \
} \
index++; \
} while (0)
#define APPLY_C_PREDICTOR() \ #define APPLY_C_PREDICTOR() \
predictor_pair = s->c_predictor_table[index]; \ predictor_pair = s->c_predictor_table[index]; \
horiz_pred += (predictor_pair >> 1); \ horiz_pred += (predictor_pair >> 1); \
@@ -527,10 +536,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \ if (predictor_pair & 1) \
GET_NEXT_INDEX() \ GET_NEXT_INDEX() \
else \ else \
index++; \ INC_INDEX; \
} \ } \
} else \ } else \
index++; INC_INDEX;
#define APPLY_C_PREDICTOR_24() \ #define APPLY_C_PREDICTOR_24() \
predictor_pair = s->c_predictor_table[index]; \ predictor_pair = s->c_predictor_table[index]; \
@@ -544,10 +553,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \ if (predictor_pair & 1) \
GET_NEXT_INDEX() \ GET_NEXT_INDEX() \
else \ else \
index++; \ INC_INDEX; \
} \ } \
} else \ } else \
index++; INC_INDEX;
#define APPLY_Y_PREDICTOR() \ #define APPLY_Y_PREDICTOR() \
@@ -562,10 +571,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \ if (predictor_pair & 1) \
GET_NEXT_INDEX() \ GET_NEXT_INDEX() \
else \ else \
index++; \ INC_INDEX; \
} \ } \
} else \ } else \
index++; INC_INDEX;
#define APPLY_Y_PREDICTOR_24() \ #define APPLY_Y_PREDICTOR_24() \
predictor_pair = s->y_predictor_table[index]; \ predictor_pair = s->y_predictor_table[index]; \
@@ -579,10 +588,10 @@ hres,vres,i,i%vres (0 < i < 4)
if (predictor_pair & 1) \ if (predictor_pair & 1) \
GET_NEXT_INDEX() \ GET_NEXT_INDEX() \
else \ else \
index++; \ INC_INDEX; \
} \ } \
} else \ } else \
index++; INC_INDEX;
#define OUTPUT_PIXEL_PAIR() \ #define OUTPUT_PIXEL_PAIR() \
*current_pixel_pair = *vert_pred + horiz_pred; \ *current_pixel_pair = *vert_pred + horiz_pred; \