eessppeelllloo/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2026-06-16 04:32:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

dsputil/pngdsp: fix signed/unsigned type in end comparison

Browse Source 
Fixes out of array accesses and integer overflows.

(cherry picked from commit d1916d13e2)
Adresses: CVE-2013-7010, CVE-2013-7014

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
(cherry picked from commit af9799790d)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

Conflicts:
	libavcodec/pngdsp.c
This commit is contained in:
Michael Niedermayer
2013-08-30 23:14:32 +02:00
committed by Reinhard Tartler
parent d04194db45
commit ef6c90e102
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libavcodec/dsputil.c
+2 -2
View File
@@ -1867,7 +1867,7 @@ void ff_set_cmp(DSPContext* c, me_cmp_func *cmp, int type){
static void add_bytes_c(uint8_t *dst, uint8_t *src, int w){
long i;
for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
for (i = 0; i <= w - (int) sizeof(long); i += sizeof(long)) {
long a = *(long*)(src+i);
long b = *(long*)(dst+i);
*(long*)(dst+i) = ((a&pb_7f) + (b&pb_7f)) ^ ((a^b)&pb_80);
@@ -1903,7 +1903,7 @@ static void diff_bytes_c(uint8_t *dst, uint8_t *src1, uint8_t *src2, int w){
}
}else
#endif
for(i=0; i<=w-sizeof(long); i+=sizeof(long)){
for (i = 0; i <= w - (int) sizeof(long); i += sizeof(long)) {
long a = *(long*)(src1+i);
long b = *(long*)(src2+i);
*(long*)(dst+i) = ((a|pb_80) - (b&pb_7f)) ^ ((a^b^pb_80)&pb_80);