[FFmpeg-devel] [PATCH] indeo3: add out-of-buffer write check
stefano.sabatini-lala at poste.it
Sun May 22 23:44:37 CEST 2011
On date Thursday 2011-05-19 08:29:49 +0200, Reimar Döffinger encoded:
> On 18 May 2011, at 11:38, Stefano Sabatini <stefano.sabatini-lala at poste.it> wrote:
> > On date Wednesday 2011-05-18 07:53:31 +0200, Reimar Döffinger encoded:
> >> On 17 May 2011, at 22:30, Stefano Sabatini <stefano.sabatini-lala at poste.it> wrote:
> >>> Prevent out-of-buffer reads. In particular fix smclocki32.avi.1.1
> >>> crash, fix trac issue #114, roundup issue #1482.
> >>> ---
> >>> libavcodec/indeo3.c | 3 +++
> >>> 1 files changed, 3 insertions(+), 0 deletions(-)
> >>> diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
> >>> index fb33a7c..37124e4 100644
> >>> --- a/libavcodec/indeo3.c
> >>> +++ b/libavcodec/indeo3.c
> >>> @@ -208,6 +208,7 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
> >>> int *width_tbl, width_tbl_arr;
> >>> const signed char *ref_vectors;
> >>> uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2;
> >>> + uint8_t *cur_end = cur + width*height + width;
> >>> uint32_t *cur_lp, *ref_lp;
> >>> const uint32_t *correction_lp, *correctionloworder_lp, *correctionhighorder_lp;
> >>> uint8_t *correction_type_sp;
> >>> @@ -354,6 +355,8 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
> >>> k = *buf1++;
> >>> cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2];
> >>> ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2];
> >>> + if ((uint8_t *)cur_lp >= cur_end)
> >>> + break;
> >> Not sure it matters, but this could still overread with cur_lp == cur_end - 1
> > In practice cur_lp is always a pointer to uint32_t, so is is always
> > incremented by 4 units. A better solution would involve to fix the
> > code logic, but that would require a better understanding of the
> > codec.
> I was more thinking of cur_end being odd for example.
Yes, updated with a more restrictive check (which doesn't seem to
cause problems to my indeo3 samples).
I'll apply soon if I see no comments.
FFmpeg = Fundamental and Furious Murdering Puritan Eager Genius
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 1477 bytes
Desc: not available
More information about the ffmpeg-devel