diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-03-02 04:15:40 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-03-02 04:38:30 +0100 |
| commit | 52a213865670ae69c1852d4d04cf41f8929abbd0 (patch) | |
| tree | adb709d71d2fe225023b4eba84eb939d2b15b663 /libavformat/avidec.c | |
| parent | 73f930ee71e0206243fdbbb7617f9721835aacea (diff) | |
avformat/avidec: Use a buffer with sufficient padding in read_gab2_sub()
Fixes out of array read
Fixes: 0ff9841c2a102f06e0d582bfc3376cbd-asan_heap-oob_495589_6836_cov_1763916974_mewmew_ssa.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/avidec.c')
| -rw-r--r-- | libavformat/avidec.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/libavformat/avidec.c b/libavformat/avidec.c index bab62a08c1..f79b0dfb6d 100644 --- a/libavformat/avidec.c +++ b/libavformat/avidec.c @@ -904,12 +904,14 @@ fail: static int read_gab2_sub(AVStream *st, AVPacket *pkt) { if (pkt->size >= 7 && + pkt->size < INT_MAX - AVPROBE_PADDING_SIZE && !strcmp(pkt->data, "GAB2") && AV_RL16(pkt->data + 5) == 2) { uint8_t desc[256]; int score = AVPROBE_SCORE_EXTENSION, ret; AVIStream *ast = st->priv_data; AVInputFormat *sub_demuxer; AVRational time_base; + int size; AVIOContext *pb = avio_alloc_context(pkt->data + 7, pkt->size - 7, 0, NULL, NULL, NULL, NULL); @@ -927,9 +929,15 @@ static int read_gab2_sub(AVStream *st, AVPacket *pkt) avio_rl16(pb); /* flags? */ avio_rl32(pb); /* data size */ - pd = (AVProbeData) { .buf = pb->buf_ptr, - .buf_size = pb->buf_end - pb->buf_ptr }; - if (!(sub_demuxer = av_probe_input_format2(&pd, 1, &score))) + size = pb->buf_end - pb->buf_ptr; + pd = (AVProbeData) { .buf = av_mallocz(size + AVPROBE_PADDING_SIZE), + .buf_size = size }; + if (!pd.buf) + goto error; + memcpy(pd.buf, pb->buf_ptr, size); + sub_demuxer = av_probe_input_format2(&pd, 1, &score); + av_freep(&pd.buf); + if (!sub_demuxer) goto error; if (!(ast->sub_ctx = avformat_alloc_context())) |