[FFmpeg-cvslog] avcodec/rawdec: Check side data size before use
Michael Niedermayer
git at videolan.org
Mon Dec 5 19:46:46 EET 2016
ffmpeg | branch: release/3.1 | Michael Niedermayer <michael at niedermayer.cc> | Sun Oct 30 15:12:12 2016 +0100| [a190ca54f438db4d050ab0fce319fb41c3a85b46] | committer: Michael Niedermayer
avcodec/rawdec: Check side data size before use
Fixes out of array read
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
(cherry picked from commit 5f0bc0215a0f7099a2bcba5dced2e045e70fee61)
Signed-off-by: Michael Niedermayer <michael at niedermayer.cc>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a190ca54f438db4d050ab0fce319fb41c3a85b46
---
libavcodec/rawdec.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/libavcodec/rawdec.c b/libavcodec/rawdec.c
index 5a98258..2d348da 100644
--- a/libavcodec/rawdec.c
+++ b/libavcodec/rawdec.c
@@ -364,9 +364,16 @@ static int raw_decode(AVCodecContext *avctx, void *data, int *got_frame,
}
if (avctx->pix_fmt == AV_PIX_FMT_PAL8) {
+ int pal_size;
const uint8_t *pal = av_packet_get_side_data(avpkt, AV_PKT_DATA_PALETTE,
- NULL);
+ &pal_size);
int ret;
+
+ if (pal_size != AVPALETTE_SIZE) {
+ av_log(avctx, AV_LOG_ERROR, "Palette size %d is wrong\n", pal_size);
+ pal = NULL;
+ }
+
if (!context->palette)
context->palette = av_buffer_alloc(AVPALETTE_SIZE);
if (!context->palette) {
More information about the ffmpeg-cvslog
mailing list