avcodec/tdsc: Fix tile checks

Fixes: out of array access Fixes: crash.asf

Michael Niedermayer committed 6 years ago

Commit 081e3001 parent 85447831 file · +10 −11Browse files

Unified · Split

     for (i = 0; i < number_tiles; i++) {
         int tile_size;
         int tile_mode;
-        int x, y, w, h;
+        int x, y, x2, y2, w, h;
         int ret;
         if (bytestream2_get_bytes_left(&ctx->gbc) < 4 ||
         bytestream2_skip(&ctx->gbc, 4); // unknown
         x = bytestream2_get_le32(&ctx->gbc);
         y = bytestream2_get_le32(&ctx->gbc);
-        w = bytestream2_get_le32(&ctx->gbc) - x;
+        x2 = bytestream2_get_le32(&ctx->gbc);
-        h = bytestream2_get_le32(&ctx->gbc) - y;
+        y2 = bytestream2_get_le32(&ctx->gbc);
-        if (x >= ctx->width || y >= ctx->height) {
+        if (x < 0 || y < 0 || x2 <= x || y2 <= y ||
+            x2 > ctx->width || y2 > ctx->height
+        ) {
             av_log(avctx, AV_LOG_ERROR,
-                   "Invalid tile position (%d.%d outside %dx%d).\n",
+                   "Invalid tile position (%d.%d %d.%d outside %dx%d).\n",
-                   x, y, ctx->width, ctx->height);
+                   x, y, x2, y2, ctx->width, ctx->height);
-            return AVERROR_INVALIDDATA;
-        }
-        if (x + w > ctx->width || y + h > ctx->height) {
-            av_log(avctx, AV_LOG_ERROR,
-                   "Invalid tile size %dx%d\n", w, h);
             return AVERROR_INVALIDDATA;
         }
+        w = x2 - x;
+        h = y2 - y;
         ret = av_reallocp(&ctx->tilebuffer, tile_size);
         if (!ctx->tilebuffer)

Keyboard shortcuts