Module: libav Branch: release/9 Commit: 64867f3cb507b4f309d9e444ba9ddb66bd6b32e2
Author: Luca Barbato <lu_z...@gentoo.org> Committer: Luca Barbato <lu_z...@gentoo.org> Date: Sat Jun 29 06:37:32 2013 +0200 pcx: Do not overread source buffer in pcx_rle_decode Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-sta...@libav.org (cherry picked from commit 3abde1a3b49cf299f2aae4eaae6b6cb5270bdc22) Signed-off-by: Luca Barbato <lu_z...@gentoo.org> --- libavcodec/pcx.c | 27 ++++++++++++++++++--------- 1 files changed, 18 insertions(+), 9 deletions(-) diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c index 1bd8612..ba3703a 100644 --- a/libavcodec/pcx.c +++ b/libavcodec/pcx.c @@ -44,16 +44,19 @@ static av_cold int pcx_init(AVCodecContext *avctx) { /** * @return advanced src pointer */ -static const uint8_t *pcx_rle_decode(const uint8_t *src, uint8_t *dst, - unsigned int bytes_per_scanline, int compressed) { +static const uint8_t *pcx_rle_decode(const uint8_t *src, + const uint8_t *end, + uint8_t *dst, + unsigned int bytes_per_scanline, + int compressed) { unsigned int i = 0; unsigned char run, value; if (compressed) { - while (i<bytes_per_scanline) { + while (i < bytes_per_scanline && src < end) { run = 1; value = *src++; - if (value >= 0xc0) { + if (value >= 0xc0 && src < end) { run = value & 0x3f; value = *src++; } @@ -88,6 +91,7 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, unsigned int w, h, bits_per_pixel, bytes_per_line, nplanes, stride, y, x, bytes_per_scanline; uint8_t *ptr; + const uint8_t *buf_end = buf + buf_size; uint8_t const *bufstart = buf; uint8_t *scanline; int ret = -1; @@ -116,7 +120,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, nplanes = buf[65]; bytes_per_scanline = nplanes * bytes_per_line; - if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8) { + if (bytes_per_scanline < w * bits_per_pixel * nplanes / 8 || + (!compressed && bytes_per_scanline > buf_size / h)) { av_log(avctx, AV_LOG_ERROR, "PCX data is corrupted\n"); return -1; } @@ -164,7 +169,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, if (nplanes == 3 && bits_per_pixel == 8) { for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { ptr[3*x ] = scanline[x ]; @@ -179,7 +185,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, const uint8_t *palstart = bufstart + buf_size - 769; for (y=0; y<h; y++, ptr+=stride) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); memcpy(ptr, scanline, w); } @@ -198,7 +205,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, for (y=0; y<h; y++) { init_get_bits(&s, scanline, bytes_per_scanline<<3); - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) ptr[x] = get_bits(&s, bits_per_pixel); @@ -209,7 +217,8 @@ static int pcx_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, int i; for (y=0; y<h; y++) { - buf = pcx_rle_decode(buf, scanline, bytes_per_scanline, compressed); + buf = pcx_rle_decode(buf, buf_end, + scanline, bytes_per_scanline, compressed); for (x=0; x<w; x++) { int m = 0x80 >> (x&7), v = 0; _______________________________________________ libav-commits mailing list libav-commits@libav.org https://lists.libav.org/mailman/listinfo/libav-commits