MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/avidec: Use a buffer with sufficient padding in read_gab2_sub()

Browse Source 
Fixes out of array read
Fixes: 0ff9841c2a102f06e0d582bfc3376cbd-asan_heap-oob_495589_6836_cov_1763916974_mewmew_ssa.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-03-02 04:15:40 +01:00
parent 73f930ee71
commit 52a2138656
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
libavformat/avidec.c
View File

@ -904,12 +904,14 @@ fail:
static int read_gab2_sub(AVStream *st, AVPacket *pkt)
{
if (pkt->size >= 7 &&
pkt->size < INT_MAX - AVPROBE_PADDING_SIZE &&
!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) {
uint8_t desc[256];
int score = AVPROBE_SCORE_EXTENSION, ret;
AVIStream *ast = st->priv_data;
AVInputFormat *sub_demuxer;
AVRational time_base;
int size;
AVIOContext *pb = avio_alloc_context(pkt->data + 7,
pkt->size - 7,
0, NULL, NULL, NULL, NULL);
@ -927,9 +929,15 @@ static int read_gab2_sub(AVStream *st, AVPacket *pkt)
avio_rl16(pb); /* flags? */
avio_rl32(pb); /* data size */
pd = (AVProbeData) { .buf = pb->buf_ptr,
.buf_size = pb->buf_end - pb->buf_ptr };
if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score)))
size = pb->buf_end - pb->buf_ptr;
pd = (AVProbeData) { .buf = av_mallocz(size + AVPROBE_PADDING_SIZE),
.buf_size = size };
if (!pd.buf)
goto error;
memcpy(pd.buf, pb->buf_ptr, size);
sub_demuxer = av_probe_input_format2(&pd, 1, &score);
av_freep(&pd.buf);
if (!sub_demuxer)
goto error;
if (!(ast->sub_ctx = avformat_alloc_context()))