diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2005-04-20 09:52:04 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2005-04-20 09:52:04 +0000 |
| commit | f707a5ebba734597b1ff0810931b55b630077ab3 (patch) | |
| tree | aeeff1e4ed7413bec4aa9d6a6a0f44114c4a3e3d /libavcodec/indeo2.c | |
| parent | 856dbbff7f3e7a78cc1a435cacf7f273f3e7277d (diff) | |
buffer overflows
Originally committed as revision 4142 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/indeo2.c')
| -rw-r--r-- | libavcodec/indeo2.c | 18 |
1 files changed, 15 insertions, 3 deletions
diff --git a/libavcodec/indeo2.c b/libavcodec/indeo2.c index a2f4583c64..f1d2c80afe 100644 --- a/libavcodec/indeo2.c +++ b/libavcodec/indeo2.c @@ -53,7 +53,7 @@ if (value > 255) \ else if (value < 0) \ value = 0; \ -static void ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, +static int ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, const uint8_t *table) { int i; @@ -62,11 +62,16 @@ static void ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *ds int c; int t; + if(width&1) + return -1; + /* first line contain absolute values, other lines contain deltas */ while (out < width){ c = ir2_get_code(&ctx->gb); if(c > 0x80) { /* we have a run */ c -= 0x80; + if(out + c*2 > width) + return -1; for (i = 0; i < c * 2; i++) dst[out++] = 0x80; } else { /* copy two values from table */ @@ -82,6 +87,8 @@ static void ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *ds c = ir2_get_code(&ctx->gb); if(c > 0x80) { /* we have a skip */ c -= 0x80; + if(out + c*2 > width) + return -1; for (i = 0; i < c * 2; i++) { dst[out] = dst[out - stride]; out++; @@ -99,16 +106,20 @@ static void ir2_decode_plane(Ir2Context *ctx, int width, int height, uint8_t *ds } dst += stride; } + return 0; } -static void ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, +static int ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8_t *dst, int stride, const uint8_t *table) { int j; int out = 0; int c; int t; - + + if(width&1) + return -1; + for (j = 0; j < height; j++){ out = 0; while (out < width){ @@ -129,6 +140,7 @@ static void ir2_decode_plane_inter(Ir2Context *ctx, int width, int height, uint8 } dst += stride; } + return 0; } static int ir2_decode_frame(AVCodecContext *avctx, |