[FFmpeg-devel] [PATCH] ituh263dec: Prevent overreading header buffer

[Timothy Gu]

On Oct 21, 2013 8:44 AM, "Derek Buitenhuis" <derek.buitenhuis at gmail.com>
wrote:
>
> Signed-off-by: Derek Buitenhuis <derek.buitenhuis at gmail.com>
> ---
> Fixes a crash in a sample I have.
> ---
>  libavcodec/ituh263dec.c |    5 +++++
>  1 files changed, 5 insertions(+), 0 deletions(-)
>
> diff --git a/libavcodec/ituh263dec.c b/libavcodec/ituh263dec.c
> index 08aeb30..6c7c12d 100644
> --- a/libavcodec/ituh263dec.c
> +++ b/libavcodec/ituh263dec.c
> @@ -874,6 +874,11 @@ int ff_h263_decode_picture_header(MpegEncContext *s)
>
>      align_get_bits(&s->gb);
>
> +    if (get_bits_left(&s->gb) < 22 - 8) {
> +        av_log(s->avctx, AV_LOG_ERROR, "Not enough bits to decode
header.\n");
> +        return -1;

Meaningful return code

> +    }
> +
>      if (show_bits(&s->gb, 2) == 2 && s->avctx->frame_number == 0) {
>           av_log(s->avctx, AV_LOG_WARNING, "Header looks like RTP instead
of H.263\n");
>      }
> --
> 1.7.1
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel at ffmpeg.org
> http://ffmpeg.org/mailman/listinfo/ffmpeg-devel