| Message ID | 20210529093530.15419-1-michael@niedermayer.cc |
|---|---|
| State | Accepted |
| Commit | 4c1afa292520329eecd1cc7631bc59a8cca95c46 |
| Headers | show |
| Series | [FFmpeg-devel,1/3] avformat/movenc: Check pal_size before use | expand |
| Context | Check | Description |
|---|---|---|
| andriy/x86_make | success | Make finished |
| andriy/x86_make_fate | success | Make fate finished |
| andriy/PPC64_make | success | Make finished |
| andriy/PPC64_make_fate | success | Make fate finished |
On Sat, May 29, 2021 at 11:35:28AM +0200, Michael Niedermayer wrote: > Fixes: assertion failure > Fixes: out of array read > Fixes: Ticket8190 > Fixes: CVE-2020-22015 > > Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> > --- > libavformat/movenc.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) will apply patchset [...]
diff --git a/libavformat/movenc.c b/libavformat/movenc.c index 2ab507df15..7d839f447b 100644 --- a/libavformat/movenc.c +++ b/libavformat/movenc.c @@ -2160,11 +2160,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex avio_wb16(pb, 0x18); /* Reserved */ if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) { - int pal_size = 1 << track->par->bits_per_coded_sample; - int i; + int pal_size, i; avio_wb16(pb, 0); /* Color table ID */ avio_wb32(pb, 0); /* Color table seed */ avio_wb16(pb, 0x8000); /* Color table flags */ + if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8) + return AVERROR(EINVAL); + pal_size = 1 << track->par->bits_per_coded_sample; avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */ for (i = 0; i < pal_size; i++) { uint32_t rgb = track->palette[i];
Fixes: assertion failure Fixes: out of array read Fixes: Ticket8190 Fixes: CVE-2020-22015 Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> --- libavformat/movenc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)