[FFmpeg-cvslog] lagarith: check count before writing zeros.
Michael Niedermayer
git at videolan.org
Sat Sep 29 15:16:34 CEST 2012
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sat Apr 14 18:28:31 2012 +0200| [b631e4ed64f7d1b9ca8f897fda31140e8d1fad81] | committer: Anton Khirnov
lagarith: check count before writing zeros.
Fixes CVE-2012-2793
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton at khirnov.net>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=b631e4ed64f7d1b9ca8f897fda31140e8d1fad81
---
libavcodec/lagarith.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index e365610..a34c289 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -361,6 +361,11 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
output_zeros:
if (l->zeros_rem) {
count = FFMIN(l->zeros_rem, width - i);
+ if (end - dst < count) {
+ av_log(l->avctx, AV_LOG_ERROR, "Too many zeros remaining.\n");
+ return AVERROR_INVALIDDATA;
+ }
+
memset(dst, 0, count);
l->zeros_rem -= count;
dst += count;
More information about the ffmpeg-cvslog
mailing list