[FFmpeg-cvslog] huffyuv: pad classic huffman tables so as to avoid bitreader overread.

Michael Niedermayer git at videolan.org
Fri Mar 2 19:03:40 CET 2012


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Fri Mar  2 18:49:39 2012 +0100| [8fdd93eaadc6ea2cbbe16d00d378a45e6c740b31] | committer: Michael Niedermayer

huffyuv: pad classic huffman tables so as to avoid bitreader overread.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=8fdd93eaadc6ea2cbbe16d00d378a45e6c740b31
---

 libavcodec/huffyuv.c |   10 ++++++----
 1 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
index d6bda7b..b9ba6dd 100644
--- a/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@ -85,13 +85,15 @@ typedef struct HYuvContext{
 static const unsigned char classic_shift_luma[] = {
   34,36,35,69,135,232,9,16,10,24,11,23,12,16,13,10,14,8,15,8,
   16,8,17,20,16,10,207,206,205,236,11,8,10,21,9,23,8,8,199,70,
-  69,68, 0
+  69,68, 0,
+  0,0,0,0,0,0,0,0,
 };
 
 static const unsigned char classic_shift_chroma[] = {
   66,36,37,38,39,40,41,75,76,77,110,239,144,81,82,83,84,85,118,183,
   56,57,88,89,56,89,154,57,58,57,26,141,57,56,58,57,58,57,184,119,
-  214,245,116,83,82,49,80,79,78,77,44,75,41,40,39,38,37,36,34, 0
+  214,245,116,83,82,49,80,79,78,77,44,75,41,40,39,38,37,36,34, 0,
+  0,0,0,0,0,0,0,0,
 };
 
 static const unsigned char classic_add_luma[256] = {
@@ -394,10 +396,10 @@ static int read_old_huffman_tables(HYuvContext *s){
     GetBitContext gb;
     int i;
 
-    init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8);
+    init_get_bits(&gb, classic_shift_luma, (sizeof(classic_shift_luma)-8)*8);
     if(read_len_table(s->len[0], &gb)<0)
         return -1;
-    init_get_bits(&gb, classic_shift_chroma, sizeof(classic_shift_chroma)*8);
+    init_get_bits(&gb, classic_shift_chroma, (sizeof(classic_shift_chroma)-8)*8);
     if(read_len_table(s->len[1], &gb)<0)
         return -1;
 



More information about the ffmpeg-cvslog mailing list