Module: libav
Branch: release/12
Commit: cacc54ffaab861ec9df288b19079f649f40e32a1
Author: Anton Khirnov <an...@khirnov.net>
Committer: Anton Khirnov <an...@khirnov.net>
Date: Sun Aug 14 10:18:39 2016 +0200
pcx: check that the packet is large enough before reading the header
Fixes possible invalid reads.
CC: libav-sta...@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit 221402c1c88b9d12130c6f5834029b535ee0e0c5)
Signed-off-by: Anton Khirnov <an...@khirnov.net>
---
libavcodec/pcx.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/libavcodec/pcx.c b/libavcodec/pcx.c
index 77b2331..2191ad1 100644
--- a/libavcodec/pcx.c
+++ b/libavcodec/pcx.c
@@ -28,6 +28,8 @@
#include "get_bits.h"
#include "internal.h"
+#define PCX_HEADER_SIZE 128
+
/**
* @return advanced src pointer
*/
@@ -85,6 +87,11 @@ static int pcx_decode_frame(AVCodecContext *avctx, void
*data, int *got_frame,
uint8_t *scanline;
int ret = -1;
+ if (buf_size < PCX_HEADER_SIZE) {
+ av_log(avctx, AV_LOG_ERROR, "Packet too small\n");
+ return AVERROR_INVALIDDATA;
+ }
+
if (buf[0] != 0x0a || buf[1] > 5) {
av_log(avctx, AV_LOG_ERROR, "this is not PCX encoded data\n");
return AVERROR_INVALIDDATA;
_______________________________________________
libav-commits mailing list
libav-commits@libav.org
https://lists.libav.org/mailman/listinfo/libav-commits
