[FFmpeg-cvslog] sanm: Check MV before using them.

Michael Niedermayer git at videolan.org
Tue Jan 29 22:55:19 CET 2013


ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue Jan 29 22:35:37 2013 +0100| [dc8dd2f6e972985f3ed237019bc7c70731af8148] | committer: Michael Niedermayer

sanm: Check MV before using them.

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=dc8dd2f6e972985f3ed237019bc7c70731af8148
---

 libavcodec/sanm.c |   11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/libavcodec/sanm.c b/libavcodec/sanm.c
index 70ad1f8..c928492 100644
--- a/libavcodec/sanm.c
+++ b/libavcodec/sanm.c
@@ -29,6 +29,7 @@
 #include "libavutil/imgutils.h"
 #include "libavcodec/dsputil.h"
 #include "sanm_data.h"
+#include "libavutil/avassert.h"
 
 #define NGLYPHS 256
 
@@ -613,6 +614,16 @@ static int process_block(SANMVideoContext *ctx, uint8_t *dst, uint8_t *prev1,
     } else {
         int mx = motion_vectors[code][0];
         int my = motion_vectors[code][1];
+        int index = prev2 - (const uint8_t*)ctx->frm2;
+
+        av_assert2(index >= 0 && index < (ctx->buf_size>>1));
+
+        if (index < - mx - my*stride ||
+            (ctx->buf_size>>1) - index < mx + size + (my + size - 1)*stride) {
+            av_log(ctx->avctx, AV_LOG_ERROR, "MV is invalid \n");
+            return AVERROR_INVALIDDATA;
+        }
+
         for (k = 0; k < size; k++)
             memcpy(dst + k * stride, prev2 + mx + (my + k) * stride, size);
     }



More information about the ffmpeg-cvslog mailing list