Commit 52a21386 authored by Michael Niedermayer's avatar Michael Niedermayer

avformat/avidec: Use a buffer with sufficient padding in read_gab2_sub()

Fixes out of array read
Fixes: 0ff9841c2a102f06e0d582bfc3376cbd-asan_heap-oob_495589_6836_cov_1763916974_mewmew_ssa.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 73f930ee
......@@ -904,12 +904,14 @@ fail:
static int read_gab2_sub(AVStream *st, AVPacket *pkt)
{
if (pkt->size >= 7 &&
pkt->size < INT_MAX - AVPROBE_PADDING_SIZE &&
!strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) {
uint8_t desc[256];
int score = AVPROBE_SCORE_EXTENSION, ret;
AVIStream *ast = st->priv_data;
AVInputFormat *sub_demuxer;
AVRational time_base;
int size;
AVIOContext *pb = avio_alloc_context(pkt->data + 7,
pkt->size - 7,
0, NULL, NULL, NULL, NULL);
......@@ -927,9 +929,15 @@ static int read_gab2_sub(AVStream *st, AVPacket *pkt)
avio_rl16(pb); /* flags? */
avio_rl32(pb); /* data size */
pd = (AVProbeData) { .buf = pb->buf_ptr,
.buf_size = pb->buf_end - pb->buf_ptr };
if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score)))
size = pb->buf_end - pb->buf_ptr;
pd = (AVProbeData) { .buf = av_mallocz(size + AVPROBE_PADDING_SIZE),
.buf_size = size };
if (!pd.buf)
goto error;
memcpy(pd.buf, pb->buf_ptr, size);
sub_demuxer = av_probe_input_format2(&pd, 1, &score);
av_freep(&pd.buf);
if (!sub_demuxer)
goto error;
if (!(ast->sub_ctx = avformat_alloc_context()))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment