[FFmpeg-devel] [PATCH 6/6] avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_ext()

[Carl Eugen Hoyos]

2018-07-03 23:05 GMT+02:00, Michael Niedermayer <michael at niedermayer.cc>:
> Fixes: out of array read
> Fixes: asff-crash-0e53d0dc491dfdd507530b66562812fbd4c36678
>
> Found-by: Paul Ch <paulcher at icloud.com>
> Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> ---
>  libavcodec/mpeg4videodec.c | 11 ++++++++++-
>  1 file changed, 10 insertions(+), 1 deletion(-)
>
> diff --git a/libavcodec/mpeg4videodec.c b/libavcodec/mpeg4videodec.c
> index 2df525e03a..24c280df46 100644
> --- a/libavcodec/mpeg4videodec.c
> +++ b/libavcodec/mpeg4videodec.c
> @@ -2867,11 +2867,13 @@ static int decode_vop_header(Mpeg4DecContext *ctx,
> GetBitContext *gb)
>      return 0;
>  }
>
> -static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
> +static int read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)

Why is changing the return type of this function useful (in the context
of the actual patch)?

Carl Eugen