History

bfi: Use bytestream2 functions to prevent buffer overreads.

Aneesh Dogra committed 14 years ago

Commit ccc27e21 parent 529a25d1 file · +14 −12Browse files

Unified · Split

libavcodec/bfi.c+14−12
@@ -47,7 +47,7 @@ static av_cold int bfi_decode_init(AVCodecContext *avctx) · 46 unmodified lines
4747 static int bfi_decode_frame(AVCodecContext *avctx, void *data,
4848 int *data_size, AVPacket *avpkt)
4949 {
50− const uint8_t *buf = avpkt->data, *buf_end = avpkt->data + avpkt->size;
50+ GetByteContext g;
5151 int buf_size = avpkt->size;
5252 BFIContext *bfi = avctx->priv_data;
5353 uint8_t *dst = bfi->dst;
@@ -66,6 +66,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 12 unmodified lines
6666 return -1;
6767 }
6868
69+ bytestream2_init(&g, avpkt->data, buf_size);
70+
6971 /* Set frame parameters and palette, if necessary */
7072 if (!avctx->frame_number) {
7173 bfi->frame.pict_type = AV_PICTURE_TYPE_I;
@@ -91,15 +93,15 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 19 unmodified lines
9193 bfi->frame.key_frame = 0;
9294 }
9395
94− buf += 4; // Unpacked size, not required.
96+ bytestream2_skip(&g, 4); // Unpacked size, not required.
9597
9698 while (dst != frame_end) {
9799 static const uint8_t lentab[4] = { 0, 2, 0, 1 };
98− unsigned int byte = *buf++, av_uninit(offset);
100+ unsigned int byte = bytestream2_get_byte(&g), av_uninit(offset);
99101 unsigned int code = byte >> 6;
100102 unsigned int length = byte & ~0xC0;
101103
102− if (buf >= buf_end) {
104+ if (!bytestream2_get_bytes_left(&g)) {
103105 av_log(avctx, AV_LOG_ERROR,
104106 "Input resolution larger than actual frame.\n");
105107 return -1;
@@ -108,16 +110,16 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 2 unmodified lines
108110 /* Get length and offset(if required) */
109111 if (length == 0) {
110112 if (code == 1) {
111− length = bytestream_get_byte(&buf);
112− offset = bytestream_get_le16(&buf);
113+ length = bytestream2_get_byte(&g);
114+ offset = bytestream2_get_le16(&g);
113115 } else {
114− length = bytestream_get_le16(&buf);
116+ length = bytestream2_get_le16(&g);
115117 if (code == 2 && length == 0)
116118 break;
117119 }
118120 } else {
119121 if (code == 1)
120− offset = bytestream_get_byte(&buf);
122+ offset = bytestream2_get_byte(&g);
121123 }
122124
123125 /* Do boundary check */
@@ -127,11 +129,11 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 3 unmodified lines
127129 switch (code) {
128130
129131 case 0: //Normal Chain
130− if (length >= buf_end - buf) {
132+ if (length >= bytestream2_get_bytes_left(&g)) {
131133 av_log(avctx, AV_LOG_ERROR, "Frame larger than buffer.\n");
132134 return -1;
133135 }
134− bytestream_get_buffer(&buf, dst, length);
136+ bytestream2_get_buffer(&g, dst, length);
135137 dst += length;
136138 break;
137139
@@ -149,8 +151,8 @@ static int bfi_decode_frame(AVCodecContext *avctx, void *data, · 11 unmodified lines
149151 break;
150152
151153 case 3: //Fill Chain
152− colour1 = bytestream_get_byte(&buf);
153− colour2 = bytestream_get_byte(&buf);
154+ colour1 = bytestream2_get_byte(&g);
155+ colour2 = bytestream2_get_byte(&g);
154156 while (length--) {
155157 *dst++ = colour1;
156158 *dst++ = colour2;

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t