[FFmpeg-devel] [PATCH] Check for invalid slice offsets in real decoder.

[Laurent Aimar]

On Tue, Sep 20, 2011 at 01:37:03AM +0200, Michael Niedermayer wrote:
> On Mon, Sep 19, 2011 at 10:48:53PM +0200, fenrir at elivagar.org wrote:
> > From: Laurent Aimar <fenrir at videolan.org>
> > 
> > ---
> >  libavcodec/rv34.c |    9 +++++----
> >  1 files changed, 5 insertions(+), 4 deletions(-)
> > 
> > diff --git a/libavcodec/rv34.c b/libavcodec/rv34.c
> > index 8223e92..a760e5e 100644
> > --- a/libavcodec/rv34.c
> > +++ b/libavcodec/rv34.c
> > @@ -1488,8 +1488,9 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
> >          slice_count = avctx->slice_count;
> >  
> >      //parse first slice header to check whether this frame can be decoded
> > -    if(get_slice_offset(avctx, slices_hdr, 0) > buf_size){
> > -        av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
> > +    if(get_slice_offset(avctx, slices_hdr, 0) < 0 ||
> > +       get_slice_offset(avctx, slices_hdr, 0) > buf_size){
> > +        av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
> >          return -1;
> >      }
> >      init_get_bits(&s->gb, buf+get_slice_offset(avctx, slices_hdr, 0), (buf_size-get_slice_offset(avctx, slices_hdr, 0))*8);
> > @@ -1512,8 +1513,8 @@ int ff_rv34_decode_frame(AVCodecContext *avctx,
> >          else
> >              size = get_slice_offset(avctx, slices_hdr, i+1) - offset;
> >  
> > -        if(offset > buf_size){
> > -            av_log(avctx, AV_LOG_ERROR, "Slice offset is greater than frame size\n");
> > +        if(offset < 0 || offset > buf_size || size < 0){
> > +            av_log(avctx, AV_LOG_ERROR, "Slice offset is invalid\n");
> >              break;
> >          }
> 
> applied but i think this is not sufficient
> slice i+2 is read a bit below and seem unchecked
Good catch, I will provid a patch.
Thanks.

-- 
fenrir