From patchwork Fri Nov 17 16:20:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Derek Buitenhuis X-Patchwork-Id: 6141 Delivered-To: ffmpegpatchwork@gmail.com Received: by 10.2.161.94 with SMTP id m30csp818576jah; Fri, 17 Nov 2017 08:30:11 -0800 (PST) X-Google-Smtp-Source: AGs4zMbhJ54gyTA8qWvCiaf0agvZggn4Us9Kx/M7dF1upRX1uAqVLSsvwDY4Fs/3s41p/IsOzLuD X-Received: by 10.28.143.212 with SMTP id r203mr4503217wmd.44.1510936211537; Fri, 17 Nov 2017 08:30:11 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1510936211; cv=none; d=google.com; s=arc-20160816; b=Z0ZiGJxWWoaDjnRL96vEXp5eg5x1Bbd1r3D+Yl/eCOIgaJUQPorMPOk27VHTAXUXJU rIzuWvSJuCyXIAkQolhY6MBasVK9c+W3SKXDUQnXaiGoeAPJl3IlgNqzAK6NKVpVHeK3 ukd+Zwqm2a7LO6Tqq6vrqQkBvhwV1/KJVgKFNeAn4kuypRlK5z0zKOJN82up8hkDAthA lmSoeS/12gXe6u0nKrRyGmz42/7oB4JlzKNqE1ZlESPzXoFqERhbjyrah2vMQnQ7rxcI vfBe2dBPfakPXzkNobJEH8iIgYi67/6BFY9oWlSSvu6OyI+lFKhzFci8uZ4aZOOW1rBZ 8CRA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=sender:errors-to:content-transfer-encoding:mime-version:reply-to :list-subscribe:list-help:list-post:list-archive:list-unsubscribe :list-id:precedence:subject:message-id:date:to:from:dkim-signature :delivered-to:arc-authentication-results; bh=1QMSNH6WvjnZ3wzfoe5IvC3r97C39OdbVsRQReeK56w=; b=Kx8GwArr49fF1EdpOMCNfYI726vQZMAHfUqQyOrXKpEOWDNf4KYlbcZWB2xIi51fJ/ Blkyh+XczIW27wSlSyqbvzbf89P7Lfh94yNftU7CcJ3BW/KXnuX4B1usZeLh1AvaRt7y ML5CBLxzRHgwE2hyQiktGqA7tr2w3dUa+h4ehOqDGYQpxX9Xxt2ZZvLiNfZy4H73oZMb r+x9flMLWpUnLceQeuG/fS5Mks0TCgMQVnBgjAgyXO/0vEkQb9PbS2tNvLuZc8m7U2z6 oGYGB2iDj2n8J8v8Vz5SEWi0IL9cb9xf7R8CpzFY/GVTamRscmyusaE+JOBo1VSOUbkm Zm/A== ARC-Authentication-Results: i=1; mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=WyDTi5SD; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmail.com Return-Path: Received: from ffbox0-bg.mplayerhq.hu (ffbox0-bg.ffmpeg.org. [79.124.17.100]) by mx.google.com with ESMTP id b15si2982028wmg.240.2017.11.17.08.30.11; Fri, 17 Nov 2017 08:30:11 -0800 (PST) Received-SPF: pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) client-ip=79.124.17.100; Authentication-Results: mx.google.com; dkim=neutral (body hash did not verify) header.i=@gmail.com header.s=20161025 header.b=WyDTi5SD; spf=pass (google.com: domain of ffmpeg-devel-bounces@ffmpeg.org designates 79.124.17.100 as permitted sender) smtp.mailfrom=ffmpeg-devel-bounces@ffmpeg.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=gmail.com Received: from [127.0.1.1] (localhost [127.0.0.1]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTP id BEA4B689953; Fri, 17 Nov 2017 18:29:53 +0200 (EET) X-Original-To: ffmpeg-devel@ffmpeg.org Delivered-To: ffmpeg-devel@ffmpeg.org Received: from mail-wm0-f65.google.com (mail-wm0-f65.google.com [74.125.82.65]) by ffbox0-bg.mplayerhq.hu (Postfix) with ESMTPS id D21216883E8 for ; Fri, 17 Nov 2017 18:29:47 +0200 (EET) Received: by mail-wm0-f65.google.com with SMTP id g130so4019022wme.0 for ; Fri, 17 Nov 2017 08:30:04 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:subject:date:message-id; bh=nmDrPnkrQkubC3Zw4KvO7/D70P4mkChoSTOhXIhg/+s=; b=WyDTi5SDybTt/sdkvViWmN4SgUBoJ8AMA26toGITqGZgHrmLEUWJx2n5YTtMO4pLkk 2FxioitzXqUQeCasF7j/NbBURHiAuRtb3Xp9ttLNzCxp+fBcE6ulV4XIqU2oHpKQflqj mB9fL8B8IUK7g+XgtZEw/0yTyrx1QRdm7/wRL6OM54ZAbT5FwVs+RV1f5jghRuorbDH1 jlYezZqTiB9GYN9tZ4H1jcfb+1JOsmA/hhhEu2c9jOMmJBozXyzPJWv8Mapb3GnD8O8V X5xqtaU0JDy6KxAqqH/RVa782eCjy7aH2T+Qn+NGrLBrezIf4n28qqB54lHelmj30IV7 1+Kg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=nmDrPnkrQkubC3Zw4KvO7/D70P4mkChoSTOhXIhg/+s=; b=BXSTJ+uuB8RKnAyKzgFyyFQaVWfKDtWfvCmuCZF2hYueAcPpK2AMRKLPu3y2pCsein IkvH5DVjhqhRV0W5f7GdCTDf3kwWc6w7FDjXJS2bIU8wMrBR2hByaJ3WZkpzWjaZftQR y8GnEsOWhDe/uGwaS2TS7ktt7F8fDXJpX6mjh9rYAKTmU1UupzXPOjWhpevA2LGjWuoJ li/sjtEug1hMO1dGzRr53w0HUsJmh5eTWXYarw/uuCvrbVWtMxEx+7ENX0wxQE9Uflqb qtp5Cf3mZMvWcfVwCSOZSHT1Xcnry81f7Q4R/lL6URVCcHYRijCU8sfUnxZDsjnxktGt QUew== X-Gm-Message-State: AJaThX5kSOWlVK5D8WOkUrO0RS4XEsuoM3dW9zyTcYWjx0fGjHykFy7Y roqFPAznIweSVHw/9lmWKkn23b00 X-Received: by 10.28.10.147 with SMTP id 141mr4154929wmk.40.1510935716461; Fri, 17 Nov 2017 08:21:56 -0800 (PST) Received: from localhost.localdomain ([149.12.3.113]) by smtp.gmail.com with ESMTPSA id 2sm4567921wre.17.2017.11.17.08.21.55 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Nov 2017 08:21:55 -0800 (PST) From: Derek Buitenhuis To: ffmpeg-devel@ffmpeg.org Date: Fri, 17 Nov 2017 16:20:55 +0000 Message-Id: <20171117162055.7128-1-derek.buitenhuis@gmail.com> X-Mailer: git-send-email 2.15.0 Subject: [FFmpeg-devel] [PATCH] dvenc: Prevent out-of-bounds read X-BeenThere: ffmpeg-devel@ffmpeg.org X-Mailman-Version: 2.1.20 Precedence: list List-Id: FFmpeg development discussions and patches List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: FFmpeg development discussions and patches MIME-Version: 1.0 Errors-To: ffmpeg-devel-bounces@ffmpeg.org Sender: "ffmpeg-devel" mb_area_start has 5 entries, and 'a' is iterated through from 0 to 3. 'a2' is set to 'a + 1', and mb_area_start[a2 + 1] is accessed, so if a is 3, then we try to access mb_area_start[5]. Signed-off-by: Derek Buitenhuis --- I'm not 100% sure if this fix is /correct/, so hopefully someone knows the DV code... --- libavcodec/dvenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libavcodec/dvenc.c b/libavcodec/dvenc.c index ce2fc75daa..b79cbebb04 100644 --- a/libavcodec/dvenc.c +++ b/libavcodec/dvenc.c @@ -383,7 +383,7 @@ static inline void dv_guess_qnos(EncBlockInfo *blks, int *qnos) prev = k; } else { if (b->next[k] >= mb_area_start[a + 1] && b->next[k] < 64) { - for (a2 = a + 1; b->next[k] >= mb_area_start[a2 + 1]; a2++) + for (a2 = a + 1; a2 < 4 && b->next[k] >= mb_area_start[a2 + 1]; a2++) b->prev[a2] = prev; av_assert2(a2 < 4); av_assert2(b->mb[b->next[k]]);