On Sat, Sep 29, 2012 at 02:04:51PM +0200, Anton Khirnov wrote: > From: Michael Niedermayer <[email protected]> > > This prevents writing into a too small array if some parameters changed > without the tile being reallocated. > > Fixes CVE-2012-2794 > > Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind > Signed-off-by: Anton Khirnov <[email protected]> > --- > libavcodec/indeo5.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c > index 4f8e0d8..4044a04 100644 > --- a/libavcodec/indeo5.c > +++ b/libavcodec/indeo5.c > @@ -430,6 +430,12 @@ static int decode_mb_info(IVI45DecContext *ctx, > IVIBandDesc *band, > ((band->qdelta_present && band->inherit_qdelta) || band->inherit_mv)) > return AVERROR_INVALIDDATA; > > + if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, > band->mb_size)) { > + av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches > parameters %d\n", > + tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, > band->mb_size)); > + return AVERROR_INVALIDDATA; > + } > + > /* scale factor for motion vectors */ > mv_scale = (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3); > mv_x = mv_y = 0; > --
looks OK _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
