[FFmpeg-devel] [PATCH] indeo3: add out-of-buffer write check

[Reimar Döffinger]

On 18 May 2011, at 11:38, Stefano Sabatini <stefano.sabatini-lala at poste.it> wrote:
> On date Wednesday 2011-05-18 07:53:31 +0200, Reimar Döffinger encoded:
>> 
>> On 17 May 2011, at 22:30, Stefano Sabatini <stefano.sabatini-lala at poste.it> wrote:
>> 
>>> Prevent out-of-buffer reads. In particular fix smclocki32.avi.1.1
>>> crash, fix trac issue #114, roundup issue #1482.
>>> ---
>>> libavcodec/indeo3.c |    3 +++
>>> 1 files changed, 3 insertions(+), 0 deletions(-)
>>> 
>>> diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
>>> index fb33a7c..37124e4 100644
>>> --- a/libavcodec/indeo3.c
>>> +++ b/libavcodec/indeo3.c
>>> @@ -208,6 +208,7 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
>>>    int *width_tbl, width_tbl_arr[10];
>>>    const signed char *ref_vectors;
>>>    uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2;
>>> +    uint8_t *cur_end = cur + width*height + width;
>>>    uint32_t *cur_lp, *ref_lp;
>>>    const uint32_t *correction_lp[2], *correctionloworder_lp[2], *correctionhighorder_lp[2];
>>>    uint8_t *correction_type_sp[2];
>>> @@ -354,6 +355,8 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
>>>                            k = *buf1++;
>>>                            cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2];
>>>                            ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2];
>>> +                            if ((uint8_t *)cur_lp >= cur_end)
>>> +                                break;
>> 
>> Not sure it matters, but this could still overread with cur_lp == cur_end - 1
> 
> In practice cur_lp is always a pointer to uint32_t, so is is always
> incremented by 4 units. A better solution would involve to fix the
> code logic, but that would require a better understanding of the
> codec.

I was more thinking of cur_end being odd for example.