[libav-commits] lagarith: check count before writing zeros.

Michael Niedermayer git at libav.org
Sun Oct 14 22:20:52 CEST 2012


Module: libav
Branch: release/0.8
Commit: 14bba214fa9a143c61f95c62941c105d7c3b6ddd

Author:    Michael Niedermayer <michaelni at gmx.at>
Committer: Reinhard Tartler <siretart at tauware.de>
Date:      Sat Apr 14 18:28:31 2012 +0200

lagarith: check count before writing zeros.

Fixes CVE-2012-2793

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Anton Khirnov <anton at khirnov.net>
(cherry picked from commit b631e4ed64f7d1b9ca8f897fda31140e8d1fad81)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

---

 libavcodec/lagarith.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/libavcodec/lagarith.c b/libavcodec/lagarith.c
index 6828ba8..f04d89b 100644
--- a/libavcodec/lagarith.c
+++ b/libavcodec/lagarith.c
@@ -326,6 +326,11 @@ static int lag_decode_zero_run_line(LagarithContext *l, uint8_t *dst,
 output_zeros:
     if (l->zeros_rem) {
         count = FFMIN(l->zeros_rem, width - i);
+        if (end - dst < count) {
+            av_log(l->avctx, AV_LOG_ERROR, "Too many zeros remaining.\n");
+            return AVERROR_INVALIDDATA;
+        }
+
         memset(dst, 0, count);
         l->zeros_rem -= count;
         dst += count;



More information about the libav-commits mailing list