videolan
/
ffmpeg
mirror of https://git.videolan.org/git/ffmpeg.git
1
Fork 0
Code Releases Activity

dxa: check vectors of 2x2 motion blocks 

Fixes out of array reads

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-05-07 20:33:33 +02:00
parent f96e0eb238
commit ead590c256
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/dxa.c
View File

@ -133,6 +133,11 @@ static int decode_13(AVCodecContext *avctx, DxaDecContext *c, uint8_t* dst,
case 0x80: // motion compensation
x = (*mv) >> 4; if(x & 8) x = 8 - x;
y = (*mv++) & 0xF; if(y & 8) y = 8 - y;
if (i + 2*(k & 1) < -x || avctx->width - i - 2*(k & 1) - 2 < x ||
j + (k & 2) < -y || avctx->height - j - (k & 2) - 2 < y) {
av_log(avctx, AV_LOG_ERROR, "MV %d %d out of bounds\n", x,y);
return AVERROR_INVALIDDATA;
}
tmp2 += x + y*stride;
case 0x00: // skip
tmp[d + 0 ] = tmp2[0];