highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Check for invalid slice offsets in real decoder.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 8716c178ddabe28a01a9fe81fff68d117b779333)
This commit is contained in:
Laurent Aimar 2011-09-19 22:48:53 +02:00 committed by Michael Niedermayer
parent 3899b3be0c
commit d2c5904cab
1 changed files with 5 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/rv34.c
View File

@ -1452,8 +1452,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = avctx->slice_count;
//parse first slice header to check whether this frame can be decoded
if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
return -1;
}
init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8);
@ -1476,8 +1477,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
else
size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
if(offset > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
if(offset < 0 || offset > buf_size || size < 0){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break;
}