[FFmpeg-devel] [PATCH] indeo3: add out-of-buffer write check

[Stefano Sabatini]

On date Monday 2011-05-23 21:03:07 +0200, Michael Niedermayer encoded:
> On Mon, May 23, 2011 at 05:40:11PM +0200, Laurent Aimar wrote:
> > Hi,
> > 
> > > Prevent out-of-buffer writes. In particular fix smclocki32.avi.1.1
> > > crash, fix trac issue #114, roundup issue #1482.
> > > ---
> > >  libavcodec/indeo3.c |    3 +++
> > >  1 files changed, 3 insertions(+), 0 deletions(-)
> > > 
> > > diff --git a/libavcodec/indeo3.c b/libavcodec/indeo3.c
> > > index b74fcf7..8e55fbe 100644
> > > --- a/libavcodec/indeo3.c
> > > +++ b/libavcodec/indeo3.c
> > > @@ -213,6 +213,7 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
> > >      int *width_tbl, width_tbl_arr[10];
> > >      const signed char *ref_vectors;
> > >      uint8_t *cur_frm_pos, *ref_frm_pos, *cp, *cp2;
> > > +    uint8_t *cur_end = cur + width*height + width;
> > >      uint32_t *cur_lp, *ref_lp;
> > >      const uint32_t *correction_lp[2], *correctionloworder_lp[2], *correctionhighorder_lp[2];
> > >      uint8_t *correction_type_sp[2];
> > > @@ -359,6 +360,8 @@ static void iv_Decode_Chunk(Indeo3DecodeContext *s,
> > >                              k = *buf1++;
> > >                              cur_lp = ((uint32_t *)cur_frm_pos) + width_tbl[lp2];
> > >                              ref_lp = ((uint32_t *)ref_frm_pos) + width_tbl[lp2];
> > > +                            if ((uint8_t *)cur_lp >= cur_end-3)
> > > +                                break;
> > If the overflow can happen, then IMO this check is not robust enough, you can
> > have an integer overflow when computing cur_lp address.
> >  Also while at it, it seems that width_tbl can be < 0, and I am not sure it is
> > correctly checked.
> 
> Iam sure there are alot more bugs in there
> maxim has a cleaner decoder and iam hoping he will post it soon so we
> can decide which to keep before putting too much time in one that we
> might remove later

Pushed in the current form. Maxim's decoder will be possibly better
(and less obfuscated), in the meaningwhile this patch fixes a crash
with the current code.
-- 
FFmpeg = Fierce Free Mind-dumbing Peaceless Encoding/decoding Ghost