[FFmpeg-cvslog] vqavideodev: Check image dimensions

Michael Niedermayer git at videolan.org
Thu May 3 00:32:02 CEST 2012


ffmpeg | branch: release/0.10 | Michael Niedermayer <michaelni at gmx.at> | Thu Mar 22 23:43:37 2012 +0100| [1ee1e9e43ff35c3d3f0e36c6f3f2e604179d2c73] | committer: Michael Niedermayer

vqavideodev: Check image dimensions

Fixes out of heap array read

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 3583c8706df0abbfa3ecdd6730f4f3d72a01fe6d)
Independently-Found-by: Fabian Yamaguchi
Fixes: CVE-2012-0947

Conflicts:

	libavcodec/vqavideo.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1ee1e9e43ff35c3d3f0e36c6f3f2e604179d2c73
---

 libavcodec/vqavideo.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
index 08d419d..d5182ed 100644
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -160,6 +160,11 @@ static av_cold int vqa_decode_init(AVCodecContext *avctx)
     s->codebook = av_malloc(s->codebook_size);
     s->next_codebook_buffer = av_malloc(s->codebook_size);
 
+    if (s->width % s->vector_width || s->height % s->vector_height) {
+        av_log(avctx, AV_LOG_ERROR, "Picture dimensions are not a multiple of the vector size\n");
+        return AVERROR_INVALIDDATA;
+    }
+
     /* initialize the solid-color vectors */
     if (s->vector_height == 4) {
         codebook_index = 0xFF00 * 16;



More information about the ffmpeg-cvslog mailing list