[FFmpeg-devel] [PATCH] Check for invalid slice offsets in real decoder.

[Michael Niedermayer]

On Mon, Sep 19, 2011 at 10:48:53PM +0200, fenrir at elivagar.org wrote:
> From: Laurent Aimar <fenrir at videolan.org>
> 
> ---
>  libavcodec/rv34.c |    9 +++++----
>  1 files changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
> index 8223e92..a760e5e 100644
> --- a/libavcodec/rv34.c
> +++ b/libavcodec/rv34.c
> @@ -1488,8 +1488,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
>          slice_count = avctx->slice_count;
>  
>      //parse first slice header to check whether this frame can be decoded
> -    if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
> -        av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
> +    if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
> +       get_slice_offset(avctx, slices_hdr, 0) > buf_size){
> +        av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
>          return -1;
>      }
>      init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8);
> @@ -1512,8 +1513,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
>          else
>              size = get_slice_offset(avctx, slices_hdr, i+1) - offset;
>  
> -        if(offset > buf_size){
> -            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
> +        if(offset < 0 || offset > buf_size || size < 0){
> +            av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
>              break;
>          }

applied but i think this is not sufficient
slice i+2 is read a bit below and seem unchecked

[...]
-- 
Michael     GnuPG fingerprint: 9FF2128B147EF6730BADF133611EC787040B0FAB

Those who are best at talking, realize last or never when they are wrong.
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: Digital signature
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20110920/dc298040/attachment.asc>