On 18.12.2015 20:08, Luca Barbato wrote:
> On 18/12/15 20:04, Andreas Cadhalpun wrote:
>> This is used to check if the input buffer is larger enough, so if this
>> overflows it can cause a false negative leading to a segmentation fault
>> in bytestream2_get_bufferu.
>>
>> Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
>> ---
>> libavcodec/xwddec.c | 6 ++++++
>> 1 file changed, 6 insertions(+)
>>
>> diff --git a/libavcodec/xwddec.c b/libavcodec/xwddec.c
>> index 2febedc..311eeec 100644
>> --- a/libavcodec/xwddec.c
>> +++ b/libavcodec/xwddec.c
>> @@ -127,6 +127,12 @@ static int xwd_decode_frame(AVCodecContext *avctx, void
>> *data,
>> return AVERROR_INVALIDDATA;
>> }
>>
>> + if (lsize > UINT_MAX / avctx->height) {
>> + av_log(avctx, AV_LOG_ERROR, "lsize %u too large for height %d\n",
>> + lsize, avctx->height);
>> + return AVERROR_INVALIDDATA;
>> + }
>> +
>> if (ncolors > 256) {
>> av_log(avctx, AV_LOG_ERROR, "invalid number of entries in
>> colormap\n");
>> return AVERROR_INVALIDDATA;
>>
>
> Should go after the av_image_check_size or you'd have a division by 0.
Indeed. Updated patch attached.
Best regards,
Andreas
>From fb40616d7b432680b92dc3adc44a5b5d12fac55d Mon Sep 17 00:00:00 2001
From: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
Date: Fri, 18 Dec 2015 19:28:51 +0100
Subject: [PATCH] xwddec: prevent overflow of lsize * avctx->height
This is used to check if the input buffer is larger enough, so if this
overflows it can cause a false negative leading to a segmentation fault
in bytestream2_get_bufferu.
Signed-off-by: Andreas Cadhalpun <andreas.cadhal...@googlemail.com>
---
libavcodec/xwddec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/xwddec.c b/libavcodec/xwddec.c
index 2febedc..103252b 100644
--- a/libavcodec/xwddec.c
+++ b/libavcodec/xwddec.c
@@ -135,6 +135,12 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data,
if ((ret = av_image_check_size(avctx->width, avctx->height, 0, NULL)) < 0)
return ret;
+ if (lsize > UINT_MAX / avctx->height) {
+ av_log(avctx, AV_LOG_ERROR, "lsize %u too large for height %d\n",
+ lsize, avctx->height);
+ return AVERROR_INVALIDDATA;
+ }
+
rsize = FFALIGN(avctx->width * bpp, bpad) / 8;
if (lsize < rsize) {
av_log(avctx, AV_LOG_ERROR, "invalid bytes per scan-line\n");
--
2.6.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
http://ffmpeg.org/mailman/listinfo/ffmpeg-devel
