diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 21:50:20 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-11-12 23:01:42 +0100 |
| commit | 7ab690bf5f4b24fca95113c0ee44f0847c9c3c6d (patch) | |
| tree | 8e78b17e920a0019b99e82ad40d55eff0b7101b3 | |
| parent | 7581ad24a9240e9af4f344d0cb6a41fbe7ae71cd (diff) | |
indeo4: more complete check for the scan vs block sizes.
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/indeo4.c | 6 | ||||
| -rw-r--r-- | libavcodec/ivi_common.h | 1 |
2 files changed, 7 insertions, 0 deletions
diff --git a/libavcodec/indeo4.c b/libavcodec/indeo4.c index 1d6d0490e6..0766ed489a 100644 --- a/libavcodec/indeo4.c +++ b/libavcodec/indeo4.c @@ -365,6 +365,7 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, return AVERROR_INVALIDDATA; } band->scan = scan_index_to_tab[scan_indx]; + band->scan_size = band->blk_size; quant_mat = get_bits(&ctx->gb, 5); if (quant_mat == 31) { @@ -382,6 +383,11 @@ static int decode_band_hdr(IVI45DecContext *ctx, IVIBandDesc *band, band->quant_mat = 0; return AVERROR_INVALIDDATA; } + if (band->scan_size != band->blk_size) { + av_log(avctx, AV_LOG_ERROR, "mismatching scan table!\n"); + return AVERROR_INVALIDDATA; + } + /* decode block huffman codebook */ if (ff_ivi_dec_huff_desc(&ctx->gb, get_bits1(&ctx->gb), IVI_BLK_HUFF, &band->blk_vlc, avctx)) diff --git a/libavcodec/ivi_common.h b/libavcodec/ivi_common.h index 44b28cd231..e3afe435e0 100644 --- a/libavcodec/ivi_common.h +++ b/libavcodec/ivi_common.h @@ -152,6 +152,7 @@ typedef struct IVIBandDesc { int quant_mat; ///< dequant matrix index int glob_quant; ///< quant base for this band const uint8_t *scan; ///< ptr to the scan pattern + int scan_size; ///< size of the scantable IVIHuffTab blk_vlc; ///< vlc table for decoding block data |