[FFmpeg-cvslog] fraps: Make the input buffer size checks more strict

Martin Storsjö git at videolan.org
Thu Jan 16 22:49:48 CET 2014


ffmpeg | branch: release/0.10 | Martin Storsjö <martin at martin.st> | Thu Sep 19 16:29:23 2013 +0300| [fbc52044f3d07f4f059214b314d17fd07bc4e12f] | committer: Luca Barbato

fraps: Make the input buffer size checks more strict

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
Signed-off-by: Martin Storsjö <martin at martin.st>

Conflicts:
	libavcodec/fraps.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=fbc52044f3d07f4f059214b314d17fd07bc4e12f
---

 libavcodec/fraps.c |   35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/libavcodec/fraps.c b/libavcodec/fraps.c
index 4d03057..23cfee8 100644
--- a/libavcodec/fraps.c
+++ b/libavcodec/fraps.c
@@ -139,10 +139,17 @@ static int decode_frame(AVCodecContext *avctx,
     uint32_t offs[4];
     int i, j, is_chroma, planes;
     enum PixelFormat pix_fmt;
+    int prev_pic_bit, expected_size;
+
+    if (buf_size < 4) {
+        av_log(avctx, AV_LOG_ERROR, "Packet is too short\n");
+        return AVERROR_INVALIDDATA;
+    }
 
     header = AV_RL32(buf);
     version = header & 0xff;
     header_size = (header & (1<<30))? 8 : 4; /* bit 30 means pad to 8 bytes */
+    prev_pic_bit = header & (1U << 31); /* bit 31 means same as previous pic */
 
     if (version > 5) {
         av_log(avctx, AV_LOG_ERROR,
@@ -161,16 +168,19 @@ static int decode_frame(AVCodecContext *avctx,
     }
     avctx->pix_fmt = pix_fmt;
 
-    switch(version) {
+    expected_size = header_size;
+
+    switch (version) {
     case 0:
     default:
         /* Fraps v0 is a reordered YUV420 */
-        if ( (buf_size != avctx->width*avctx->height*3/2+header_size) &&
-             (buf_size != header_size) ) {
+        if (!prev_pic_bit)
+            expected_size += avctx->width * avctx->height * 3 / 2;
+        if (buf_size != expected_size) {
             av_log(avctx, AV_LOG_ERROR,
                    "Invalid frame length %d (should be %d)\n",
-                   buf_size, avctx->width*avctx->height*3/2+header_size);
-            return -1;
+                   buf_size, expected_size);
+            return AVERROR_INVALIDDATA;
         }
 
         if (( (avctx->width % 8) != 0) || ( (avctx->height % 2) != 0 )) {
@@ -187,8 +197,7 @@ static int decode_frame(AVCodecContext *avctx,
             av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
             return -1;
         }
-        /* bit 31 means same as previous pic */
-        f->pict_type = (header & (1U<<31))? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;
+        f->pict_type = prev_pic_bit ? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;
         f->key_frame = f->pict_type == AV_PICTURE_TYPE_I;
 
         if (f->pict_type == AV_PICTURE_TYPE_I) {
@@ -212,12 +221,13 @@ static int decode_frame(AVCodecContext *avctx,
 
     case 1:
         /* Fraps v1 is an upside-down BGR24 */
-        if ( (buf_size != avctx->width*avctx->height*3+header_size) &&
-             (buf_size != header_size) ) {
+        if (!prev_pic_bit)
+            expected_size += avctx->width * avctx->height * 3;
+        if (buf_size != expected_size) {
             av_log(avctx, AV_LOG_ERROR,
                    "Invalid frame length %d (should be %d)\n",
-                   buf_size, avctx->width*avctx->height*3+header_size);
-            return -1;
+                   buf_size, expected_size);
+            return AVERROR_INVALIDDATA;
         }
 
         f->reference = 1;
@@ -228,8 +238,7 @@ static int decode_frame(AVCodecContext *avctx,
             av_log(avctx, AV_LOG_ERROR, "reget_buffer() failed\n");
             return -1;
         }
-        /* bit 31 means same as previous pic */
-        f->pict_type = (header & (1U<<31))? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;
+        f->pict_type = prev_pic_bit ? AV_PICTURE_TYPE_P : AV_PICTURE_TYPE_I;
         f->key_frame = f->pict_type == AV_PICTURE_TYPE_I;
 
         if (f->pict_type == AV_PICTURE_TYPE_I) {



More information about the ffmpeg-cvslog mailing list