| Message ID | CAB0OVGo95xM+mLFP7Ek5HcDeVC5=QYixNmxMFTtiYY412LJKhg@mail.gmail.com |
|---|---|
| State | Accepted |
| Headers | show |
On Tue, Mar 26, 2019 at 01:38:14PM +0100, Carl Eugen Hoyos wrote: > Hi! > > Attached patch intends to fix a buffer overwrite reported today. > > Please comment, Carl Eugen > bmp.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > ab9b89481fc3c93d4a631fb1d6b25dddbdd4bb50 0001-lavc-bmp-Avoid-a-heap-buffer-overwrite-for-1bpp-inpu.patch > From bd0dfa740f879eca6b13bb841e3b8d37718460ea Mon Sep 17 00:00:00 2001 > From: Carl Eugen Hoyos <ceffmpeg@gmail.com> > Date: Tue, 26 Mar 2019 13:32:11 +0100 > Subject: [PATCH] lavc/bmp: Avoid a heap buffer overwrite for 1bpp input. > > Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon > of the Information Security Lab, Yonsei University. > --- > libavcodec/bmp.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) LGTM thx [...]
2019-03-26 20:51 GMT+01:00, Michael Niedermayer <michael@niedermayer.cc>: > On Tue, Mar 26, 2019 at 01:38:14PM +0100, Carl Eugen Hoyos wrote: >> Hi! >> >> Attached patch intends to fix a buffer overwrite reported today. >> >> Please comment, Carl Eugen > >> bmp.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) >> ab9b89481fc3c93d4a631fb1d6b25dddbdd4bb50 >> 0001-lavc-bmp-Avoid-a-heap-buffer-overwrite-for-1bpp-inpu.patch >> From bd0dfa740f879eca6b13bb841e3b8d37718460ea Mon Sep 17 00:00:00 2001 >> From: Carl Eugen Hoyos <ceffmpeg@gmail.com> >> Date: Tue, 26 Mar 2019 13:32:11 +0100 >> Subject: [PATCH] lavc/bmp: Avoid a heap buffer overwrite for 1bpp input. >> >> Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon >> of the Information Security Lab, Yonsei University. >> --- >> libavcodec/bmp.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) > > LGTM Patch applied. Thank you, Carl Eugen
tis 2019-03-26 klockan 13:38 +0100 skrev Carl Eugen Hoyos: > Hi! > > Attached patch intends to fix a buffer overwrite reported today. Funny, I was looking at this code a few weeks ago as a good candidate for some static analysis/formal verification > ptr[avctx->width - (avctx->width & 7) + j] = buf[avctx->width >> 3] >> (7 - j) & 1; An extra pair of parenthesis around the right-hand side would be prudent: (buf[avctx->width >> 3] >> (7 - j)) & 1 /Tomas
From bd0dfa740f879eca6b13bb841e3b8d37718460ea Mon Sep 17 00:00:00 2001 From: Carl Eugen Hoyos <ceffmpeg@gmail.com> Date: Tue, 26 Mar 2019 13:32:11 +0100 Subject: [PATCH] lavc/bmp: Avoid a heap buffer overwrite for 1bpp input. Found by Mingi Cho, Seoyoung Kim, and Taekyoung Kwon of the Information Security Lab, Yonsei University. --- libavcodec/bmp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/bmp.c b/libavcodec/bmp.c index 65d239e..40010ac 100644 --- a/libavcodec/bmp.c +++ b/libavcodec/bmp.c @@ -291,7 +291,7 @@ static int bmp_decode_frame(AVCodecContext *avctx, case 1: for (i = 0; i < avctx->height; i++) { int j; - for (j = 0; j < n; j++) { + for (j = 0; j < avctx->width >> 3; j++) { ptr[j*8+0] = buf[j] >> 7; ptr[j*8+1] = (buf[j] >> 6) & 1; ptr[j*8+2] = (buf[j] >> 5) & 1; @@ -301,6 +301,9 @@ static int bmp_decode_frame(AVCodecContext *avctx, ptr[j*8+6] = (buf[j] >> 1) & 1; ptr[j*8+7] = buf[j] & 1; } + for (j = 0; j < (avctx->width & 7); j++) { + ptr[avctx->width - (avctx->width & 7) + j] = buf[avctx->width >> 3] >> (7 - j) & 1; + } buf += n; ptr += linesize; } -- 1.7.10.4