[FFmpeg-cvslog] avcodec/bitstream: Check bits in ff_init_vlc_sparse()
Michael Niedermayer
git at videolan.org
Thu Apr 18 02:59:36 CEST 2013
ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Apr 18 02:47:10 2013 +0200| [fb3e3808aed843b21dd70a70bdbc4b9f7de6a00b] | committer: Michael Niedermayer
avcodec/bitstream: Check bits in ff_init_vlc_sparse()
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fb3e3808aed843b21dd70a70bdbc4b9f7de6a00b
---
libavcodec/bitstream.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/bitstream.c b/libavcodec/bitstream.c
index 6bcdadb..6598d3e 100644
--- a/libavcodec/bitstream.c
+++ b/libavcodec/bitstream.c
@@ -305,6 +305,10 @@ int ff_init_vlc_sparse(VLC *vlc, int nb_bits, int nb_codes,
GET_DATA(buf[j].bits, bits, i, bits_wrap, bits_size);\
if (!(condition))\
continue;\
+ if (buf[j].bits > 3*nb_bits || buf[j].bits>32) {\
+ av_log(NULL, AV_LOG_ERROR, "Too long VLC in init_vlc\n");\
+ return -1;\
+ }\
GET_DATA(buf[j].code, codes, i, codes_wrap, codes_size);\
if (flags & INIT_VLC_LE)\
buf[j].code = bitswap_32(buf[j].code);\
More information about the ffmpeg-cvslog
mailing list