[SCM] libav/experimental: Add sanity check for mthread_inlen, avoids crashes due to invalid reads.
siretart at users.alioth.debian.org
siretart at users.alioth.debian.org
Sun Jun 30 16:47:03 UTC 2013
The following commit has been merged in the experimental branch:
commit 46adcc27a218d381fa23ea247f1dd4bc6a60e885
Author: Reimar Döffinger <Reimar.Doeffinger at gmx.de>
Date: Sun May 31 09:59:46 2009 +0000
Add sanity check for mthread_inlen, avoids crashes due to invalid reads.
Originally committed as revision 19042 to svn://svn.ffmpeg.org/ffmpeg/trunk
diff --git a/libavcodec/lcldec.c b/libavcodec/lcldec.c
index bfb2150..5593567 100644
--- a/libavcodec/lcldec.c
+++ b/libavcodec/lcldec.c
@@ -190,6 +190,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
case COMP_MSZH:
if (c->flags & FLAG_MULTITHREAD) {
mthread_inlen = *(unsigned int*)encoded;
+ mthread_inlen = FFMIN(mthread_inlen, len - 8);
mthread_outlen = *(unsigned int*)(encoded+4);
mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size);
@@ -236,6 +237,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
if (c->flags & FLAG_MULTITHREAD) {
int ret;
mthread_inlen = *(unsigned int*)encoded;
+ mthread_inlen = FFMIN(mthread_inlen, len - 8);
mthread_outlen = *(unsigned int*)(encoded+4);
mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen);
--
Libav/FFmpeg packaging
More information about the pkg-multimedia-commits
mailing list