On Wed, Jan 25, 2012 at 2:31 PM, Alex Converse <[email protected]> wrote: > On Wed, Jan 25, 2012 at 1:43 PM, Alex Converse <[email protected]> > wrote: >> In the fate sample field_size is larger than the number of bytes >> remaining in the buffer. Furthermore the bytes to bits conversion was >> prone to integer overflow when sizing the GetBitContext. >> >> Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind >> --- >> libavcodec/mjpegbdec.c | 4 ++-- >> 1 files changed, 2 insertions(+), 2 deletions(-) >> >> diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c >> index 4ad17ab..42ece01 100644 >> --- a/libavcodec/mjpegbdec.c >> +++ b/libavcodec/mjpegbdec.c >> @@ -111,8 +111,8 @@ read_header: >> av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); >> if (sos_offs) >> { >> -// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8); >> - init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8); >> + unsigned gb_size = FFMIN(buf_end - buf_ptr - sos_offs, (1<<28) - 1) >> * 8; >> + init_get_bits(&s->gb, buf_ptr + sos_offs, gb_size); >> s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); >> s->start_code = SOS; >> if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && > > Maybe we want to check (buf_end - buf_ptr) at the beginning of each > frame? Do we want to try to support very large frames?
Here is Micheal's patch (probably mangled by my mailer). It doesn't seem to fix the field_size being too small in fate issue. From: Michael Niedermayer <[email protected]> Date: Wed, 25 Jan 2012 22:55:21 +0000 (+0100) Subject: mjpegbdec: Fix incorrect bitstream buffer size. X-Git-Url: http://git.videolan.org/?p=ffmpeg.git;a=commitdiff_plain;h=01e5e97026cf0b344abafca22b0336a2c58b2a33 mjpegbdec: Fix incorrect bitstream buffer size. Fixes CVE-2011-3947 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <[email protected]> --- diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c index 75f3d50..c8b1452 100644 --- a/libavcodec/mjpegbdec.c +++ b/libavcodec/mjpegbdec.c @@ -111,8 +111,7 @@ read_header: av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); if (sos_offs) { -// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8); - init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8); + init_get_bits(&s->gb, buf_ptr+sos_offs, FFMIN(field_size, buf_end - (buf_ptr+sos_offs))*8); s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); s->start_code = SOS; if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
