diff mbox series

[FFmpeg-devel,05/25] avcodec/magicyuv: Check early for invalid slices

Message ID 20200926102804.228089-5-andreas.rheinhardt@gmail.com
State Accepted
Commit 3c172a2fb91a758d9e15f09f96879e6e9b5a37ec
Headers show
Series [FFmpeg-devel,01/25] avcodec/photocd: Simplify parsing Huffman tables a bit | expand

Checks

Context Check Description
andriy/default pending
andriy/make success Make finished
andriy/make_fate success Make fate finished

Commit Message

Andreas Rheinhardt Sept. 26, 2020, 10:27 a.m. UTC 
Every plane of each slice has to contain at least two bytes for flags
and the type of prediction used.

Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
---
 libavcodec/magicyuv.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Paul B Mahol Sept. 26, 2020, 10:40 a.m. UTC | #1 
On Sat, Sep 26, 2020 at 12:27:44PM +0200, Andreas Rheinhardt wrote:
> Every plane of each slice has to contain at least two bytes for flags
> and the type of prediction used.
> 
> Signed-off-by: Andreas Rheinhardt <andreas.rheinhardt@gmail.com>
> ---
>  libavcodec/magicyuv.c | 2 ++
>  1 file changed, 2 insertions(+)

lgtm

> 
> diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c
> index d2f6a9b01e..6c29efc9f4 100644
> --- a/libavcodec/magicyuv.c
> +++ b/libavcodec/magicyuv.c
> @@ -614,6 +614,8 @@ static int magy_decode_frame(AVCodecContext *avctx, void *data,
>                  return AVERROR_INVALIDDATA;
>  
>              s->slices[i][j].size = next_offset - offset;
> +            if (s->slices[i][j].size < 2)
> +                return AVERROR_INVALIDDATA;
>              offset = next_offset;
>          }
>  
> -- 
> 2.25.1
> 
> _______________________________________________
> ffmpeg-devel mailing list
> ffmpeg-devel@ffmpeg.org
> https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
> 
> To unsubscribe, visit link above, or email
> ffmpeg-devel-request@ffmpeg.org with subject "unsubscribe".
diff mbox series

Patch

diff --git a/libavcodec/magicyuv.c b/libavcodec/magicyuv.c
index d2f6a9b01e..6c29efc9f4 100644
--- a/libavcodec/magicyuv.c
+++ b/libavcodec/magicyuv.c
@@ -614,6 +614,8 @@  static int magy_decode_frame(AVCodecContext *avctx, void *data,
                 return AVERROR_INVALIDDATA;
 
             s->slices[i][j].size = next_offset - offset;
+            if (s->slices[i][j].size < 2)
+                return AVERROR_INVALIDDATA;
             offset = next_offset;
         }