[FFmpeg-cvslog] avcodec/g2meet: check available space before copying palette

Michael Niedermayer git at videolan.org
Wed Jan 8 01:27:50 CET 2014


ffmpeg | branch: release/2.1 | Michael Niedermayer <michaelni at gmx.at> | Tue Nov 26 21:53:47 2013 +0100| [413065aff4efdc895ec2b4f5e9beedcc6b07376d] | committer: Michael Niedermayer

avcodec/g2meet: check available space before copying palette

Fixes out of array read
Fixes: asan_heap-uaf_ae6067_5415_g2m4.wmv

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 6d9dad6a7cb5d544d540abf941fedbd34c14d2bd)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=413065aff4efdc895ec2b4f5e9beedcc6b07376d
---

 libavcodec/g2meet.c |    2 ++
 1 file changed, 2 insertions(+)

diff --git a/libavcodec/g2meet.c b/libavcodec/g2meet.c
index b342ae7..452cd7c 100644
--- a/libavcodec/g2meet.c
+++ b/libavcodec/g2meet.c
@@ -375,6 +375,8 @@ static int kempf_decode_tile(G2MContext *c, int tile_x, int tile_y,
         src += 3;
     }
     npal = *src++ + 1;
+    if (src_end - src < npal * 3)
+        return AVERROR_INVALIDDATA;
     memcpy(pal, src, npal * 3); src += npal * 3;
     if (sub_type != 2) {
         for (i = 0; i < npal; i++) {



More information about the ffmpeg-cvslog mailing list