MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/g2meet: check tile dimensions to avoid integer overflow

Browse Source 
Fixes out of array access
Fixes: asan_heap-oob_12a55d3_30_029.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-10-30 01:19:17 +01:00
parent f05855414e
commit 32e666c354
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
libavcodec/g2meet.c
View File

@ -736,8 +736,10 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
}
c->tile_width = bytestream2_get_be32(&bc);
c->tile_height = bytestream2_get_be32(&bc);
if (!c->tile_width || !c->tile_height ||
((c->tile_width | c->tile_height) & 0xF)) {
if (c->tile_width <= 0 || c->tile_height <= 0 ||
((c->tile_width | c->tile_height) & 0xF) ||
c->tile_width * 4LL * c->tile_height >= INT_MAX
) {
av_log(avctx, AV_LOG_ERROR,
"Invalid tile dimensions %dx%d\n",
c->tile_width, c->tile_height);