[FFmpeg-devel] [libav-devel] [PATCH] xwddec: prevent overflow of lsize * avctx->height

[Andreas Cadhalpun]

On 18.12.2015 20:08, Luca Barbato wrote:
> On 18/12/15 20:04, Andreas Cadhalpun wrote:
>> This is used to check if the input buffer is larger enough, so if this
>> overflows it can cause a false negative leading to a segmentation fault
>> in bytestream2_get_bufferu.
>>
>> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun at googlemail.com>
>> ---
>>  libavcodec/xwddec.c | 6 ++++++
>>  1 file changed, 6 insertions(+)
>>
>> diff --git a/libavcodec/xwddec.c b/libavcodec/xwddec.c
>> index 2febedc..311eeec 100644
>> --- a/libavcodec/xwddec.c
>> +++ b/libavcodec/xwddec.c
>> @@ -127,6 +127,12 @@ static int xwd_decode_frame(AVCodecContext *avctx, void *data,
>>          return AVERROR_INVALIDDATA;
>>      }
>>  
>> +    if (lsize > UINT_MAX / avctx->height) {
>> +        av_log(avctx, AV_LOG_ERROR, "lsize %u too large for height %d\n",
>> +               lsize, avctx->height);
>> +        return AVERROR_INVALIDDATA;
>> +    }
>> +
>>      if (ncolors > 256) {
>>          av_log(avctx, AV_LOG_ERROR, "invalid number of entries in colormap\n");
>>          return AVERROR_INVALIDDATA;
>>
> 
> Should go after the av_image_check_size or you'd have a division by 0.

Indeed. Updated patch attached.

Best regards,
Andreas

-------------- next part --------------
A non-text attachment was scrubbed...
Name: 0001-xwddec-prevent-overflow-of-lsize-avctx-height.patch
Type: text/x-diff
Size: 1236 bytes
Desc: not available
URL: <http://ffmpeg.org/pipermail/ffmpeg-devel/attachments/20151218/0708f4d4/attachment.patch>