[FFmpeg-cvslog] avcodec/webp: validate the distance prefix code

Andreas Cadhalpun git at videolan.org
Mon Mar 9 13:26:01 CET 2015


ffmpeg | branch: release/2.2 | Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com> | Mon Mar  2 20:47:57 2015 +0100| [b55be8b266761bbef6d39195ad7bb3bfd953c4f0] | committer: Michael Niedermayer

avcodec/webp: validate the distance prefix code

According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 5de2dab12b951b2fe121eb18503accfc91cd1565)

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b55be8b266761bbef6d39195ad7bb3bfd953c4f0
---

 libavcodec/webp.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/webp.c b/libavcodec/webp.c
index 0355cb6..e06680c 100644
--- a/libavcodec/webp.c
+++ b/libavcodec/webp.c
@@ -690,6 +690,11 @@ static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
                 length = offset + get_bits(&s->gb, extra_bits) + 1;
             }
             prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->gb);
+            if (prefix_code > 39) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "distance prefix code too large: %d\n", prefix_code);
+                return AVERROR_INVALIDDATA;
+            }
             if (prefix_code < 4) {
                 distance = prefix_code + 1;
             } else {



More information about the ffmpeg-cvslog mailing list