diff mbox series

[FFmpeg-devel] avcodec/dnxhdenc: add checks for write overflows

Message ID 20220304210939.468116-1-onemda@gmail.com
State New
Headers show
Series [FFmpeg-devel] avcodec/dnxhdenc: add checks for write overflows | expand

Checks

Context Check Description
yinshiyou/make_loongarch64 success Make finished
yinshiyou/make_fate_loongarch64 fail Make fate failed
andriy/make_aarch64_jetson success Make finished
andriy/make_fate_aarch64_jetson fail Make fate failed

Commit Message

Paul B Mahol March 4, 2022, 9:09 p.m. UTC 
Also add compensation for extra data needed per packet.

Signed-off-by: Paul B Mahol <onemda@gmail.com>
---
 libavcodec/dnxhdenc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/libavcodec/dnxhdenc.c b/libavcodec/dnxhdenc.c
index ac92474e56..cba3a753e5 100644
--- a/libavcodec/dnxhdenc.c
+++ b/libavcodec/dnxhdenc.c
@@ -1220,7 +1220,7 @@  static int dnxhd_encode_fast(AVCodecContext *avctx, DNXHDEncContext *ctx)
             avctx->execute2(avctx, dnxhd_mb_var_thread,
                             NULL, NULL, ctx->m.mb_height);
         radix_sort(ctx->mb_cmp, ctx->mb_cmp_tmp, ctx->m.mb_num);
-        for (x = 0; x < ctx->m.mb_num && max_bits > ctx->frame_bits; x++) {
+        for (x = 0; x < ctx->m.mb_num && max_bits > ctx->frame_bits - ctx->m.mb_num * 2; x++) {
             int mb = ctx->mb_cmp[x].mb;
             int rc = (ctx->qscale * ctx->m.mb_num ) + mb;
             max_bits -= ctx->mb_rc[rc].bits -
@@ -1228,6 +1228,9 @@  static int dnxhd_encode_fast(AVCodecContext *avctx, DNXHDEncContext *ctx)
             ctx->mb_qscale[mb] = ctx->qscale + 1;
             ctx->mb_bits[mb]   = ctx->mb_rc[rc + ctx->m.mb_num].bits;
         }
+
+        if ((max_bits >> 3) > (ctx->frame_bits >> 3) - ctx->data_offset - 4)
+            return AVERROR(EINVAL);
     }
     return 0;
 }