Re: [FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read

2017-11-17 Thread Derek Buitenhuis
On 11/17/2017 5:37 PM, Michael Niedermayer wrote: > hmm, i cant really remember this clearly but from looking at the code > it looks like this is the logic: > b->next[k] < 64 > b->next[k] >= mb_area_start[a + 1] implies mb_area_start[a + 1] < 64 > which implies a < 3 > and a2 < 4 on the first itera

Re: [FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read

2017-11-17 Thread Michael Niedermayer
On Fri, Nov 17, 2017 at 04:20:55PM +, Derek Buitenhuis wrote: > mb_area_start has 5 entries, and 'a' is iterated through from 0 to 3. > 'a2' is set to 'a + 1', and mb_area_start[a2 + 1] is accessed, so if > a is 3, then we try to access mb_area_start[5]. > > Signed-off-by: Derek Buitenhuis >

Re: [FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read

2017-11-17 Thread Derek Buitenhuis
On 11/17/2017 4:42 PM, Martin Vignali wrote: > doesn't know the dvenc code, > but you seems to test the assert of the next line > > Maybe move the assert (a2 < 4); before the for loop, if it's a theorical > case, > or remove it if this case can really happen. I don't see anything that would preve

Re: [FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read

2017-11-17 Thread Martin Vignali
2017-11-17 17:20 GMT+01:00 Derek Buitenhuis : > mb_area_start has 5 entries, and 'a' is iterated through from 0 to 3. > 'a2' is set to 'a + 1', and mb_area_start[a2 + 1] is accessed, so if > a is 3, then we try to access mb_area_start[5]. > > Signed-off-by: Derek Buitenhuis > --- > I'm not 100% s

[FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read

2017-11-17 Thread Derek Buitenhuis
mb_area_start has 5 entries, and 'a' is iterated through from 0 to 3. 'a2' is set to 'a + 1', and mb_area_start[a2 + 1] is accessed, so if a is 3, then we try to access mb_area_start[5]. Signed-off-by: Derek Buitenhuis --- I'm not 100% sure if this fix is /correct/, so hopefully someone knows the