[FFmpeg-cvslog] indeo5: check tile size in decode_mb_info().

Michael Niedermayer git at videolan.org
Thu Jan 17 03:00:26 CET 2013


ffmpeg | branch: release/0.8 | Michael Niedermayer <michaelni at gmx.at> | Sun Apr 15 14:11:50 2012 +0200| [aa097b4d5fd41679cda6780fd8d70a3de33c6820] | committer: Reinhard Tartler

indeo5: check tile size in decode_mb_info().

This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Fixes CVE-2012-2794

CC:libav-stable at libav.org

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton at khirnov.net>
(cherry picked from commit 2d09cdbaf2f449ba23d54e97e94bd97ca22208c6)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=aa097b4d5fd41679cda6780fd8d70a3de33c6820
---

 libavcodec/indeo5.c |    6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c
index c3f73ea..e12cd61 100644
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -457,6 +457,12 @@ static int decode_mb_info(IVI5DecContext *ctx, IVIBandDesc *band,
         ((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv))
         return AVERROR_INVALIDDATA;
 
+    if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
+        av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches parameters %d\n",
+               tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+        return AVERROR_INVALIDDATA;
+    }
+
     /* scale factor for motion vectors */
     mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3);
     mv_x = mv_y = 0;



More information about the ffmpeg-cvslog mailing list