diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 03:17:12 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-19 03:38:11 +0400 |
commit | 8eb76217d0137b7adad438f6c923310fbc1fc4c1 (patch) | |
tree | 8cd483b63fb30436f66d84878ded8074d1f6aef2 /libavcodec | |
parent | 66875798eb88be2f9e49c7d1d1b92aadac1623f6 (diff) |
avcodec/interplayvideo: Check that enough data is available for opcode_0x7/8/D
Fixes hypothetical use of uninitialized memory, no sample available
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/interplayvideo.c | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/libavcodec/interplayvideo.c b/libavcodec/interplayvideo.c index 645fc16e68..542fefe146 100644 --- a/libavcodec/interplayvideo.c +++ b/libavcodec/interplayvideo.c @@ -197,6 +197,11 @@ static int ipvideo_decode_block_opcode_0x7(IpvideoContext *s, AVFrame *frame) unsigned char P[2]; unsigned int flags; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 4) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0x7\n"); + return AVERROR_INVALIDDATA; + } + /* 2-color encoding */ P[0] = bytestream2_get_byte(&s->stream_ptr); P[1] = bytestream2_get_byte(&s->stream_ptr); @@ -236,6 +241,11 @@ static int ipvideo_decode_block_opcode_0x8(IpvideoContext *s, AVFrame *frame) unsigned char P[4]; unsigned int flags = 0; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 12) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0x8\n"); + return AVERROR_INVALIDDATA; + } + /* 2-color encoding for each 4x4 quadrant, or 2-color encoding on * either top and bottom or left and right halves */ P[0] = bytestream2_get_byte(&s->stream_ptr); @@ -477,6 +487,11 @@ static int ipvideo_decode_block_opcode_0xD(IpvideoContext *s, AVFrame *frame) int y; unsigned char P[2]; + if (bytestream2_get_bytes_left(&s->stream_ptr) < 4) { + av_log(s->avctx, AV_LOG_ERROR, "too little data for opcode 0xD\n"); + return AVERROR_INVALIDDATA; + } + /* 4-color block encoding: each 4x4 block is a different color */ for (y = 0; y < 8; y++) { if (!(y & 3)) { |