highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/dxv: Check idx in CHECKPOINT()

Browse Source 
Fixes out of array read

Fixes Ticket5098
Fixes Ticket5099

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2016-01-05 02:28:10 +01:00
parent 43624a669b
commit eb8a67de75
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/dxv.c
View File

@ -105,9 +105,17 @@ static int decompress_texture_thread(AVCodecContext *avctx, void *arg,
break; \ break; \
case 2: \ case 2: \
idx = (bytestream2_get_byte(gbc) + 2) * x; \ idx = (bytestream2_get_byte(gbc) + 2) * x; \
if (idx > pos) { \
av_log(avctx, AV_LOG_ERROR, "idx %d > %d\n", idx, pos); \
return AVERROR_INVALIDDATA; \
} \
break; \ break; \
case 3: \ case 3: \
idx = (bytestream2_get_le16(gbc) + 0x102) * x; \ idx = (bytestream2_get_le16(gbc) + 0x102) * x; \
if (idx > pos) { \
av_log(avctx, AV_LOG_ERROR, "idx %d > %d\n", idx, pos); \
return AVERROR_INVALIDDATA; \
} \
break; \ break; \
} \ } \
} while(0) } while(0)