diff options
author | Daniel Kang <daniel.d.kang@gmail.com> | 2011-01-09 22:38:32 +0300 |
---|---|---|
committer | Carl Eugen Hoyos <cehoyos@rainbow.studorg.tuwien.ac.at> | 2011-01-09 22:38:32 +0300 |
commit | b89f4fb1908f26d2704b9496952131fffd4dafae (patch) | |
tree | 52351a9b4ae51d1de6c55a7b5bfd3512bb0a7bdb /libavcodec/truemotion2.c | |
parent | a4db272a92a5556ff45ecd15735fe578ec6e81c5 (diff) |
Check for several overreads, fixes issue 2512.
Patch by Daniel Kang, daniel.d.kang at gmail
Originally committed as revision 26289 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/truemotion2.c')
-rw-r--r-- | libavcodec/truemotion2.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/libavcodec/truemotion2.c b/libavcodec/truemotion2.c index 5013a9eeb7..f4e3074c28 100644 --- a/libavcodec/truemotion2.c +++ b/libavcodec/truemotion2.c @@ -260,7 +260,8 @@ static int tm2_read_deltas(TM2Context *ctx, int stream_id) { return 0; } -static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id) { +static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id, int buf_size) +{ int i; int cur = 0; int skip = 0; @@ -274,6 +275,11 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id) { if(len == 0) return 4; + if (len >= INT_MAX/4-1 || len < 0 || len > buf_size) { + av_log(ctx->avctx, AV_LOG_ERROR, "Error, invalid stream size.\n"); + return -1; + } + toks = AV_RB32(buf); buf += 4; cur += 4; if(toks & 1) { len = AV_RB32(buf); buf += 4; cur += 4; @@ -313,8 +319,13 @@ static int tm2_read_stream(TM2Context *ctx, const uint8_t *buf, int stream_id) { len = AV_RB32(buf); buf += 4; cur += 4; if(len > 0) { init_get_bits(&ctx->gb, buf, (skip - cur) * 8); - for(i = 0; i < toks; i++) + for(i = 0; i < toks; i++) { + if (get_bits_left(&ctx->gb) <= 0) { + av_log(ctx->avctx, AV_LOG_ERROR, "Incorrect number of tokens: %i\n", toks); + return -1; + } ctx->tokens[stream_id][i] = tm2_get_token(&ctx->gb, &codes); + } } else { for(i = 0; i < toks; i++) ctx->tokens[stream_id][i] = codes.recode[0]; @@ -788,7 +799,7 @@ static int decode_frame(AVCodecContext *avctx, } for(i = 0; i < TM2_NUM_STREAMS; i++){ - t = tm2_read_stream(l, swbuf + skip, tm2_stream_order[i]); + t = tm2_read_stream(l, swbuf + skip, tm2_stream_order[i], buf_size); if(t == -1){ av_free(swbuf); return -1; |