Skip to content

F
ffmpeg.wasm-core
Commit 8716c178 authored by Laurent Aimar's avatar Laurent Aimar Committed by Michael Niedermayer
Browse files
Options

Check for invalid slice offsets in real decoder. 

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent a2544524
Hide whitespace changes
Inline Side-by-side
Showing with 5 additions and 4 deletions
libavcodec/rv34.c
View file @ 8716c178
...@@ -1492,8 +1492,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, ...@@ -1492,8 +1492,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
slice_count = avctx->slice_count; slice_count = avctx->slice_count;
//parse first slice header to check whether this frame can be decoded //parse first slice header to check whether this frame can be decoded
if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){ if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); get_slice_offset(avctx, slices_hdr, 0) > buf_size){
av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
return -1; return -1;
} }
init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8); init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8);
...@@ -1516,8 +1517,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx, ...@@ -1516,8 +1517,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
else else
size = get_slice_offset(avctx, slices_hdr, i+1) - offset; size = get_slice_offset(avctx, slices_hdr, i+1) - offset;
if(offset > buf_size){ if(offset < 0 || offset > buf_size || size < 0){
av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n"); av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
break; break;
} }
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment