Commit 46adcc27 authored by Reimar Döffinger's avatar Reimar Döffinger

Add sanity check for mthread_inlen, avoids crashes due to invalid reads.

Originally committed as revision 19042 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent 1207c84a
...@@ -190,6 +190,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac ...@@ -190,6 +190,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
case COMP_MSZH: case COMP_MSZH:
if (c->flags & FLAG_MULTITHREAD) { if (c->flags & FLAG_MULTITHREAD) {
mthread_inlen = *(unsigned int*)encoded; mthread_inlen = *(unsigned int*)encoded;
mthread_inlen = FFMIN(mthread_inlen, len - 8);
mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = *(unsigned int*)(encoded+4);
mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size); mszh_dlen = mszh_decomp(encoded + 8, mthread_inlen, c->decomp_buf, c->decomp_size);
...@@ -236,6 +237,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac ...@@ -236,6 +237,7 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, AVPac
if (c->flags & FLAG_MULTITHREAD) { if (c->flags & FLAG_MULTITHREAD) {
int ret; int ret;
mthread_inlen = *(unsigned int*)encoded; mthread_inlen = *(unsigned int*)encoded;
mthread_inlen = FFMIN(mthread_inlen, len - 8);
mthread_outlen = *(unsigned int*)(encoded+4); mthread_outlen = *(unsigned int*)(encoded+4);
mthread_outlen = FFMIN(mthread_outlen, c->decomp_size); mthread_outlen = FFMIN(mthread_outlen, c->decomp_size);
ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen); ret = zlib_decomp(avctx, encoded + 8, mthread_inlen, 0, mthread_outlen);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment