[FFmpeg-cvslog] huffyuvdec: Check init_vlc() return codes.
Michael Niedermayer
git at videolan.org
Sun Aug 18 00:01:00 CEST 2013
ffmpeg | branch: release/0.6 | Michael Niedermayer <michaelni at gmx.at> | Tue Jan 29 18:29:41 2013 +0100| [a7faa1d0703b7c2539122ea2140362411d7f62e0] | committer: Michael Niedermayer
huffyuvdec: Check init_vlc() return codes.
Prevents out of array writes
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit f67a0d115254461649470452058fa3c28c0df294)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 95ab8d33e1a680f30a5a9605175112008ab81afc)
Conflicts:
libavcodec/huffyuv.c
(cherry picked from commit 277def59fce10d91e3113e5c0f63e22bc4abfa88)
Conflicts:
libavcodec/huffyuv.c
(cherry picked from commit adf022f458d75e2c8041262e1906a249366ad518)
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=a7faa1d0703b7c2539122ea2140362411d7f62e0
---
libavcodec/huffyuv.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c
index 7764c35..d7e0f80 100644
--- a/libavcodec/huffyuv.c
+++ b/libavcodec/huffyuv.c
@@ -285,6 +285,7 @@ static void generate_joint_tables(HYuvContext *s){
int len1 = s->len[p][u];
if(len1 > limit)
continue;
+ assert(i < (1 << VLC_BITS));
len[i] = len0 + len1;
bits[i] = (s->bits[0][y] << len1) + s->bits[p][u];
symbols[i] = (y<<8) + u;
@@ -318,6 +319,7 @@ static void generate_joint_tables(HYuvContext *s){
int len2 = s->len[2][r&255];
if(len2 > limit1)
continue;
+ assert(i < (1 << VLC_BITS));
len[i] = len0 + len1 + len2;
bits[i] = (code << len2) + s->bits[2][r&255];
if(s->decorrelate){
@@ -341,6 +343,7 @@ static void generate_joint_tables(HYuvContext *s){
static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){
GetBitContext gb;
int i;
+ int ret;
init_get_bits(&gb, src, length*8);
@@ -356,7 +359,8 @@ printf("%6X, %2d, %3d\n", s->bits[i][j], s->len[i][j], j);
}
#endif
free_vlc(&s->vlc[i]);
- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+ return ret;
}
generate_joint_tables(s);
@@ -368,6 +372,7 @@ static int read_old_huffman_tables(HYuvContext *s){
#if 1
GetBitContext gb;
int i;
+ int ret;
init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8);
if(read_len_table(s->len[0], &gb)<0)
@@ -388,7 +393,8 @@ static int read_old_huffman_tables(HYuvContext *s){
for(i=0; i<3; i++){
free_vlc(&s->vlc[i]);
- init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0);
+ if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0)) < 0)
+ return ret;
}
generate_joint_tables(s);
More information about the ffmpeg-cvslog
mailing list