History

bfi: Use bytestream2 functions to prevent buffer overreads.

Aneesh Dogra committed 14 years ago

Commit ccc27e21 parent 529a25d1 file · +14 −12Browse files

Unified · Split

libavcodec/bfi.c+14−12
@@ -47,7 +47,7 @@ static av_cold int bfi_decode_init(AVCodecContext *avctx) · 46 unmodified lines
47static int bfi_decode_frame(AVCodecContext *avctx, void *data,47static int bfi_decode_frame(AVCodecContext *avctx, void *data,
48 int *data_size, AVPacket *avpkt)48 int *data_size, AVPacket *avpkt)
49{49{
50 const uint8_t *buf = avpkt->data, *buf_end = avpkt->data + avpkt->size;50 GetByteContext g;
51 int buf_size = avpkt->size;51 int buf_size = avpkt->size;
52 BFIContext *bfi = avctx->priv_data;52 BFIContext *bfi = avctx->priv_data;
53 uint8_t *dst = bfi->dst;53 uint8_t *dst = bfi->dst;
@@ -66,6 +66,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 12 unmodified lines
66 return -1;66 return -1;
67 }67 }
68 68
69 bytestream2_init(&g, avpkt->data, buf_size);
70
69 /* Set frame parameters and palette, if necessary */71 /* Set frame parameters and palette, if necessary */
70 if (!avctx->frame_number) {72 if (!avctx->frame_number) {
71 bfi->frame.pict_type = AV_PICTURE_TYPE_I;73 bfi->frame.pict_type = AV_PICTURE_TYPE_I;
@@ -91,15 +93,15 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 19 unmodified lines
91 bfi->frame.key_frame = 0;93 bfi->frame.key_frame = 0;
92 }94 }
93 95
94 buf += 4; // Unpacked size, not required.96 bytestream2_skip(&g, 4); // Unpacked size, not required.
95 97
96 while (dst != frame_end) {98 while (dst != frame_end) {
97 static const uint8_t lentab[4] = { 0, 2, 0, 1 };99 static const uint8_t lentab[4] = { 0, 2, 0, 1 };
98 unsigned int byte = *buf++, av_uninit(offset);100 unsigned int byte = bytestream2_get_byte(&g), av_uninit(offset);
99 unsigned int code = byte >> 6;101 unsigned int code = byte >> 6;
100 unsigned int length = byte & ~0xC0;102 unsigned int length = byte & ~0xC0;
101 103
102 if (buf >= buf_end) {104 if (!bytestream2_get_bytes_left(&g)) {
103 av_log(avctx, AV_LOG_ERROR,105 av_log(avctx, AV_LOG_ERROR,
104 "Input resolution larger than actual frame.\n");106 "Input resolution larger than actual frame.\n");
105 return -1;107 return -1;
@@ -108,16 +110,16 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 2 unmodified lines
108 /* Get length and offset(if required) */110 /* Get length and offset(if required) */
109 if (length == 0) {111 if (length == 0) {
110 if (code == 1) {112 if (code == 1) {
111 length = bytestream_get_byte(&buf);113 length = bytestream2_get_byte(&g);
112 offset = bytestream_get_le16(&buf);114 offset = bytestream2_get_le16(&g);
113 } else {115 } else {
114 length = bytestream_get_le16(&buf);116 length = bytestream2_get_le16(&g);
115 if (code == 2 && length == 0)117 if (code == 2 && length == 0)
116 break;118 break;
117 }119 }
118 } else {120 } else {
119 if (code == 1)121 if (code == 1)
120 offset = bytestream_get_byte(&buf);122 offset = bytestream2_get_byte(&g);
121 }123 }
122 124
123 /* Do boundary check */125 /* Do boundary check */
@@ -127,11 +129,11 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 3 unmodified lines
127 switch (code) {129 switch (code) {
128 130
129 case 0: //Normal Chain131 case 0: //Normal Chain
130 if (length >= buf_end - buf) {132 if (length >= bytestream2_get_bytes_left(&g)) {
131 av_log(avctx, AV_LOG_ERROR, "Frame larger than buffer.\n");133 av_log(avctx, AV_LOG_ERROR, "Frame larger than buffer.\n");
132 return -1;134 return -1;
133 }135 }
134 bytestream_get_buffer(&buf, dst, length);136 bytestream2_get_buffer(&g, dst, length);
135 dst += length;137 dst += length;
136 break;138 break;
137 139
@@ -149,8 +151,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 11 unmodified lines
149 break;151 break;
150 152
151 case 3: //Fill Chain153 case 3: //Fill Chain
152 colour1 = bytestream_get_byte(&buf);154 colour1 = bytestream2_get_byte(&g);
153 colour2 = bytestream_get_byte(&buf);155 colour2 = bytestream2_get_byte(&g);
154 while (length--) {156 while (length--) {
155 *dst++ = colour1;157 *dst++ = colour1;
156 *dst++ = colour2;158 *dst++ = colour2;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t