avcodec/tdsc: Fix tile checks

Fixes: out of array access Fixes: crash.asf

Michael Niedermayer committed 6 years ago

Commit 081e3001 parent 85447831 file · +10 −11Browse files

Unified · Split

@@ -390,7 +390,7 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles) · 389 unmodified lines
390	390	for (i = 0; i < number_tiles; i++) {
391	391	int tile_size;
392	392	int tile_mode;
393		− int x, y, w, h;
	393	+ int x, y, x2, y2, w, h;
394	394	int ret;
395	395
396	396	if (bytestream2_get_bytes_left(&ctx->gbc) < 4 \|\|
@@ -408,20 +408,19 @@ static int tdsc_decode_tiles(AVCodecContext *avctx, int number_tiles) · 11 unmodified lines
408	408	bytestream2_skip(&ctx->gbc, 4); // unknown
409	409	x = bytestream2_get_le32(&ctx->gbc);
410	410	y = bytestream2_get_le32(&ctx->gbc);
411		− w = bytestream2_get_le32(&ctx->gbc) - x;
412		− h = bytestream2_get_le32(&ctx->gbc) - y;
	411	+ x2 = bytestream2_get_le32(&ctx->gbc);
	412	+ y2 = bytestream2_get_le32(&ctx->gbc);
413	413
414		− if (x >= ctx->width \|\| y >= ctx->height) {
	414	+ if (x < 0 \|\| y < 0 \|\| x2 <= x \|\| y2 <= y \|\|
	415	+ x2 > ctx->width \|\| y2 > ctx->height
	416	+ ) {
415	417	av_log(avctx, AV_LOG_ERROR,
416		− "Invalid tile position (%d.%d outside %dx%d).\n",
417		− x, y, ctx->width, ctx->height);
418		− return AVERROR_INVALIDDATA;
419		− }
420		− if (x + w > ctx->width \|\| y + h > ctx->height) {
421		− av_log(avctx, AV_LOG_ERROR,
422		− "Invalid tile size %dx%d\n", w, h);
	418	+ "Invalid tile position (%d.%d %d.%d outside %dx%d).\n",
	419	+ x, y, x2, y2, ctx->width, ctx->height);
423	420	return AVERROR_INVALIDDATA;
424	421	}
	422	+ w = x2 - x;
	423	+ h = y2 - y;
425	424
426	425	ret = av_reallocp(&ctx->tilebuffer, tile_size);
427	426	if (!ctx->tilebuffer)

Keyboard shortcuts