eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-12-14 11:00:08 +01:00
Code Issues Packages Projects Releases Wiki Activity

rv34: Check for invalid slice offsets

Browse Source 
Signed-off-by: Martin Storsjö <martin@martin.st>
(cherry picked from commit 4cc7732386)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 2bbb142a14)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Laurent Aimar
2011-09-19 22:48:53 +02:00
committed by Reinhard Tartler
parent d5551d7884
commit da0900e8bb
1 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/rv34.c
View File

@@ -1444,8 +1444,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = avctx->slice_count; slice_count = avctx->slice_count;
//parse first slice header to check whether this frame can be decoded //parse first slice header to check whether this frame can be decoded
if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){ if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
return -1; return -1;
} }
init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0)); init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), buf_size-get_slice_offset(avctx, slices_hdr, 0));
@@ -1473,8 +1474,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
else else
size= get_slice_offset(avctx, slices_hdr, i+1) - offset; size= get_slice_offset(avctx, slices_hdr, i+1) - offset;
if(offset > buf_size){ if(offset < 0 || offset > buf_size || size < 0){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break; break;
} }