diff options
author | Luca Barbato <lu_zero@gentoo.org> | 2013-06-29 08:37:32 +0400 |
---|---|---|
committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-12 06:34:49 +0400 |
commit | 3abde1a3b49cf299f2aae4eaae6b6cb5270bdc22 (patch) | |
tree | 9695fd3dd4a7b05b8bceb0d4461d35981503863f /libavcodec/pcx.c | |
parent | 170fb593c617cd797d00cf05bfb8d8c21d612893 (diff) |
pcx: Do not overread source buffer in pcx_rle_decode
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
Diffstat (limited to 'libavcodec/pcx.c')
-rw-r--r-- | libavcodec/pcx.c | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c index 53f8c1992a..a6f9d8d262 100644 --- a/libavcodec/pcx.c +++ b/libavcodec/pcx.c @@ -31,7 +31,9 @@ /** * @return advanced src pointer */ -static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, +static const uint8_t *pcx_rle_decode(const uint8_t *src, + const uint8_t *end, + uint8_t *dst, unsigned int bytes_per_scanline, int compressed) { @@ -39,10 +41,10 @@ static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, unsigned char run, value; if (compressed) { - while (i < bytes_per_scanline) { + while (i < bytes_per_scanline && src < end) { run = 1; value = *src++; - if (value >= 0xc0) { + if (value >= 0xc0 && src < end) { run = value & 0x3f; value = *src++; } @@ -78,6 +80,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x, bytes_per_scanline; uint8_t *ptr; + const uint8_t *buf_end = buf + buf_size; uint8_t const *bufstart = buf; uint8_t *scanline; int ret = -1; @@ -106,7 +109,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, nplanes = buf[65]; bytes_per_scanline = nplanes * bytes_per_line; - if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) { + if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 || + (!compressed && bytes_per_scanline > buf_size / h)) { av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n"); return AVERROR_INVALIDDATA; } @@ -151,7 +155,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (nplanes == 3 && bits_per_pixel == 8) { for (y = 0; y < h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x = 0; x < w; x++) { ptr[3 * x] = scanline[x]; @@ -165,7 +170,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, const uint8_t *palstart = bufstart + buf_size - 769; for (y = 0; y < h; y++, ptr += stride) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); memcpy(ptr, scanline, w); } @@ -183,7 +189,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, for (y = 0; y < h; y++) { init_get_bits(&s, scanline, bytes_per_scanline << 3); - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x = 0; x < w; x++) ptr[x] = get_bits(&s, bits_per_pixel); @@ -193,7 +200,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int i; for (y = 0; y < h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x = 0; x < w; x++) { int m = 0x80 >> (x & 7), v = 0; |