eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

avcodec/zmbv: reject XOR data that overruns the decompression buffer

Browse Source 
Add a per-block bounds check at the start of each XOR block so the
read is rejected before src crosses decomp_len, and propagate the
error from decode_frame().

Fixes: out of array read

Found-by: Seung Min Shin
(cherry picked from commit 2a991a3475)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer
2026-05-02 11:11:02 +02:00
parent 39748cded2
commit 4931ed7ebf
1 changed files with 12 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/zmbv.c
+12 -2
View File
@@ -138,6 +138,8 @@ static int zmbv_decode_xor_8(ZmbvContext *c)
}
if (d) { /* apply XOR'ed difference */
if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2)
return AVERROR_INVALIDDATA;
out = output + x;
for (j = 0; j < bh2; j++) {
for (i = 0; i < bw2; i++)
@@ -212,6 +214,8 @@ static int zmbv_decode_xor_16(ZmbvContext *c)
}
if (d) { /* apply XOR'ed difference */
if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 2)
return AVERROR_INVALIDDATA;
out = output + x;
for (j = 0; j < bh2; j++){
for (i = 0; i < bw2; i++) {
@@ -296,6 +300,8 @@ static int zmbv_decode_xor_24(ZmbvContext *c)
}
if (d) { /* apply XOR'ed difference */
if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 3)
return AVERROR_INVALIDDATA;
out = output + x * 3;
for (j = 0; j < bh2; j++) {
for (i = 0; i < bw2; i++) {
@@ -374,6 +380,8 @@ static int zmbv_decode_xor_32(ZmbvContext *c)
}
if (d) { /* apply XOR'ed difference */
if (c->decomp_len - (src - c->decomp_buf) < bw2 * bh2 * 4)
return AVERROR_INVALIDDATA;
out = output + x;
for (j = 0; j < bh2; j++){
for (i = 0; i < bw2; i++) {
@@ -568,8 +576,10 @@ static int decode_frame(AVCodecContext *avctx, AVFrame *frame,
frame->pict_type = AV_PICTURE_TYPE_P;
if (c->decomp_len < 2LL * ((c->width + c->bw - 1) / c->bw) * ((c->height + c->bh - 1) / c->bh))
return AVERROR_INVALIDDATA;
if (c->decomp_len)
c->decode_xor(c);
if (c->decomp_len) {
if ((ret = c->decode_xor(c)) < 0)
return ret;
}
}
/* update frames */