| From 4c1afa292520329eecd1cc7631bc59a8cca95c46 Mon Sep 17 00:00:00 2001 |
| From: Michael Niedermayer <michael@niedermayer.cc> |
| Date: Sat, 29 May 2021 09:22:27 +0200 |
| Subject: [PATCH] avformat/movenc: Check pal_size before use |
| |
| Fixes: assertion failure |
| Fixes: out of array read |
| Fixes: Ticket8190 |
| Fixes: CVE-2020-22015 |
| |
| Signed-off-by: Michael Niedermayer <michael@niedermayer.cc> |
| |
| |
| CVE: CVE-2020-22015 |
| Upstream-Status: Backport [4c1afa292520329eecd1cc7631bc59a8cca95c46] |
| |
| Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com> |
| --- |
| libavformat/movenc.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| diff --git a/libavformat/movenc.c b/libavformat/movenc.c |
| index 2ab507df15..7d839f447b 100644 |
| --- a/libavformat/movenc.c |
| +++ b/libavformat/movenc.c |
| @@ -2160,11 +2160,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex |
| avio_wb16(pb, 0x18); /* Reserved */ |
| |
| if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) { |
| - int pal_size = 1 << track->par->bits_per_coded_sample; |
| - int i; |
| + int pal_size, i; |
| avio_wb16(pb, 0); /* Color table ID */ |
| avio_wb32(pb, 0); /* Color table seed */ |
| avio_wb16(pb, 0x8000); /* Color table flags */ |
| + if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8) |
| + return AVERROR(EINVAL); |
| + pal_size = 1 << track->par->bits_per_coded_sample; |
| avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */ |
| for (i = 0; i < pal_size; i++) { |
| uint32_t rgb = track->palette[i]; |
| -- |
| 2.32.0 |
| |