diff mbox

[FFmpeg-devel] avcodec/pnm: Check that the header is not truncated

Message ID 20191214183632.10999-1-michael@niedermayer.cc
State Accepted
Commit c94cb8d9b21baeeecef962c72965dbedc4e0b0e1
Headers show

Commit Message

Michael Niedermayer Dec. 14, 2019, 6:36 p.m. UTC 
Fixes: Ticket8430

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/pnm.c | 7 +++++++
 1 file changed, 7 insertions(+)

Comments

Paul B Mahol Dec. 14, 2019, 7:58 p.m. UTC | #1 
lgtm

On 12/14/19, Michael Niedermayer <michael@niedermayer.cc> wrote:
> Fixes: Ticket8430
>
> Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
> ---
>  libavcodec/pnm.c | 7 +++++++
>  1 file changed, 7 insertions(+)
>
> diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c
> index b4e5d3076b..b5c2881948 100644
> --- a/libavcodec/pnm.c
> +++ b/libavcodec/pnm.c
> @@ -117,6 +117,9 @@ int ff_pnm_decode_header(AVCodecContext *avctx,
> PNMContext * const s)
>                  return AVERROR_INVALIDDATA;
>              }
>          }
> +        if (!pnm_space(s->bytestream[-1]))
> +            return AVERROR_INVALIDDATA;
> +
>          /* check that all tags are present */
>          if (w <= 0 || h <= 0 || maxval <= 0 || maxval > UINT16_MAX || depth
> <= 0 || tuple_type[0] == '\0' ||
>              av_image_check_size(w, h, 0, avctx) || s->bytestream >=
> s->bytestream_end)
> @@ -197,6 +200,10 @@ int ff_pnm_decode_header(AVCodecContext *avctx,
> PNMContext * const s)
>          }
>      }else
>          s->maxval=1;
> +
> +    if (!pnm_space(s->bytestream[-1]))
> +        return AVERROR_INVALIDDATA;
> +
>      /* more check if YUV420 */
>      if (av_pix_fmt_desc_get(avctx->pix_fmt)->flags &
> AV_PIX_FMT_FLAG_PLANAR) {
>          if ((avctx->width & 1) != 0)
> --
> 2.24.0
>
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
>
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
Michael Niedermayer Dec. 14, 2019, 9:28 p.m. UTC | #2 
On Sat, Dec 14, 2019 at 08:58:55PM +0100, Paul B Mahol wrote:
> lgtm

will apply

thx

[...]
diff mbox

Patch

diff --git a/libavcodec/pnm.c b/libavcodec/pnm.c
index b4e5d3076b..b5c2881948 100644
--- a/libavcodec/pnm.c
+++ b/libavcodec/pnm.c
@@ -117,6 +117,9 @@  int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
                 return AVERROR_INVALIDDATA;
             }
         }
+        if (!pnm_space(s->bytestream[-1]))
+            return AVERROR_INVALIDDATA;
+
         /* check that all tags are present */
         if (w <= 0 || h <= 0 || maxval <= 0 || maxval > UINT16_MAX || depth <= 0 || tuple_type[0] == '\0' ||
             av_image_check_size(w, h, 0, avctx) || s->bytestream >= s->bytestream_end)
@@ -197,6 +200,10 @@  int ff_pnm_decode_header(AVCodecContext *avctx, PNMContext * const s)
         }
     }else
         s->maxval=1;
+
+    if (!pnm_space(s->bytestream[-1]))
+        return AVERROR_INVALIDDATA;
+
     /* more check if YUV420 */
     if (av_pix_fmt_desc_get(avctx->pix_fmt)->flags & AV_PIX_FMT_FLAG_PLANAR) {
         if ((avctx->width & 1) != 0)