Skip to content
Projects
Groups
Snippets
Help
Loading...
Help
Contribute to GitLab
Sign in / Register
Toggle navigation
F
ffmpeg.wasm-core
Project
Project
Details
Activity
Cycle Analytics
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Charts
Issues
0
Issues
0
List
Board
Labels
Milestones
Merge Requests
0
Merge Requests
0
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Charts
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Charts
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
Linshizhi
ffmpeg.wasm-core
Commits
a00676e4
Commit
a00676e4
authored
Sep 27, 2011
by
Laurent Aimar
Committed by
Janne Grunau
Oct 08, 2011
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
bink: Check for various out of bound writes
Signed-off-by:
Janne Grunau
<
janne-libav@jannau.net
>
parent
24adf783
Hide whitespace changes
Inline
Side-by-side
Showing
1 changed file
with
14 additions
and
5 deletions
+14
-5
bink.c
libavcodec/bink.c
+14
-5
No files found.
libavcodec/bink.c
View file @
a00676e4
...
...
@@ -344,14 +344,14 @@ static int read_motion_values(AVCodecContext *avctx, GetBitContext *gb, Bundle *
memset
(
b
->
cur_dec
,
v
,
t
);
b
->
cur_dec
+=
t
;
}
else
{
do
{
while
(
b
->
cur_dec
<
dec_end
)
{
v
=
GET_HUFF
(
gb
,
b
->
tree
);
if
(
v
)
{
sign
=
-
get_bits1
(
gb
);
v
=
(
v
^
sign
)
-
sign
;
}
*
b
->
cur_dec
++
=
v
;
}
while
(
b
->
cur_dec
<
dec_end
);
}
}
return
0
;
}
...
...
@@ -375,7 +375,7 @@ static int read_block_types(AVCodecContext *avctx, GetBitContext *gb, Bundle *b)
memset
(
b
->
cur_dec
,
v
,
t
);
b
->
cur_dec
+=
t
;
}
else
{
do
{
while
(
b
->
cur_dec
<
dec_end
)
{
v
=
GET_HUFF
(
gb
,
b
->
tree
);
if
(
v
<
12
)
{
last
=
v
;
...
...
@@ -383,10 +383,12 @@ static int read_block_types(AVCodecContext *avctx, GetBitContext *gb, Bundle *b)
}
else
{
int
run
=
bink_rlelens
[
v
-
12
];
if
(
dec_end
-
b
->
cur_dec
<
run
)
return
-
1
;
memset
(
b
->
cur_dec
,
last
,
run
);
b
->
cur_dec
+=
run
;
}
}
while
(
b
->
cur_dec
<
dec_end
);
}
}
return
0
;
}
...
...
@@ -456,7 +458,8 @@ static int read_dcs(AVCodecContext *avctx, GetBitContext *gb, Bundle *b,
int
start_bits
,
int
has_sign
)
{
int
i
,
j
,
len
,
len2
,
bsize
,
sign
,
v
,
v2
;
int16_t
*
dst
=
(
int16_t
*
)
b
->
cur_dec
;
int16_t
*
dst
=
(
int16_t
*
)
b
->
cur_dec
;
int16_t
*
dst_end
=
(
int16_t
*
)
b
->
data_end
;
CHECK_READ_VAL
(
gb
,
b
,
len
);
v
=
get_bits
(
gb
,
start_bits
-
has_sign
);
...
...
@@ -464,10 +467,14 @@ static int read_dcs(AVCodecContext *avctx, GetBitContext *gb, Bundle *b,
sign
=
-
get_bits1
(
gb
);
v
=
(
v
^
sign
)
-
sign
;
}
if
(
dst_end
-
dst
<
1
)
return
-
1
;
*
dst
++
=
v
;
len
--
;
for
(
i
=
0
;
i
<
len
;
i
+=
8
)
{
len2
=
FFMIN
(
len
-
i
,
8
);
if
(
dst_end
-
dst
<
len2
)
return
-
1
;
bsize
=
get_bits
(
gb
,
4
);
if
(
bsize
)
{
for
(
j
=
0
;
j
<
len2
;
j
++
)
{
...
...
@@ -535,6 +542,8 @@ static int binkb_read_bundle(BinkContext *c, GetBitContext *gb, int bundle_num)
int
i
,
len
;
CHECK_READ_VAL
(
gb
,
b
,
len
);
if
(
b
->
data_end
-
b
->
cur_dec
<
len
*
(
1
+
(
bits
>
8
)))
return
-
1
;
if
(
bits
<=
8
)
{
if
(
!
issigned
)
{
for
(
i
=
0
;
i
<
len
;
i
++
)
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment