Patrick Williams | b48b7b4 | 2016-08-17 15:04:38 -0500 | [diff] [blame^] | 1 | From b666debffec1fcbb19ef377635a53b9a58bca8a4 Mon Sep 17 00:00:00 2001 |
| 2 | From: Michael Niedermayer <michaelni@gmx.at> |
| 3 | Date: Tue, 29 Jan 2013 18:29:41 +0100 |
| 4 | Subject: [PATCH] huffyuvdec: Check init_vlc() return codes. |
| 5 | |
| 6 | Upstream-Status: Backport |
| 7 | |
| 8 | Commit b666debffec1fcbb19ef377635a53b9a58bca8a4 release/1.0 |
| 9 | |
| 10 | Prevents out of array writes |
| 11 | |
| 12 | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind |
| 13 | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> |
| 14 | (cherry picked from commit f67a0d115254461649470452058fa3c28c0df294) |
| 15 | |
| 16 | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> |
| 17 | --- |
| 18 | libavcodec/huffyuv.c | 14 ++++++++++---- |
| 19 | 1 file changed, 10 insertions(+), 4 deletions(-) |
| 20 | |
| 21 | diff --git a/libavcodec/huffyuv.c b/libavcodec/huffyuv.c |
| 22 | index 58da789..993e524 100644 |
| 23 | --- a/gst-libs/ext/libav/libavcodec/huffyuv.c |
| 24 | +++ b/gst-libs/ext/libav/libavcodec/huffyuv.c |
| 25 | @@ -33,6 +33,7 @@ |
| 26 | #include "put_bits.h" |
| 27 | #include "dsputil.h" |
| 28 | #include "thread.h" |
| 29 | +#include "libavutil/avassert.h" |
| 30 | |
| 31 | #define VLC_BITS 11 |
| 32 | |
| 33 | @@ -287,6 +287,7 @@ static void generate_joint_tables(HYuvCo |
| 34 | int len1 = s->len[p][u]; |
| 35 | if (len1 > limit || !len1) |
| 36 | continue; |
| 37 | + av_assert0(i < (1 << VLC_BITS)); |
| 38 | len[i] = len0 + len1; |
| 39 | bits[i] = (s->bits[0][y] << len1) + s->bits[p][u]; |
| 40 | symbols[i] = (y<<8) + u; |
| 41 | @@ -320,6 +321,7 @@ static void generate_joint_tables(HYuvCo |
| 42 | int len2 = s->len[2][r&255]; |
| 43 | if (len2 > limit1 || !len2) |
| 44 | continue; |
| 45 | + av_assert0(i < (1 << VLC_BITS)); |
| 46 | len[i] = len0 + len1 + len2; |
| 47 | bits[i] = (code << len2) + s->bits[2][r&255]; |
| 48 | if(s->decorrelate){ |
| 49 | @@ -343,6 +345,7 @@ static void generate_joint_tables(HYuvCo |
| 50 | static int read_huffman_tables(HYuvContext *s, const uint8_t *src, int length){ |
| 51 | GetBitContext gb; |
| 52 | int i; |
| 53 | + int ret; |
| 54 | |
| 55 | init_get_bits(&gb, src, length*8); |
| 56 | |
| 57 | @@ -353,7 +356,9 @@ static int read_huffman_tables(HYuvConte |
| 58 | return -1; |
| 59 | } |
| 60 | free_vlc(&s->vlc[i]); |
| 61 | - init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); |
| 62 | + if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, |
| 63 | + s->bits[i], 4, 4, 0)) < 0) |
| 64 | + return ret; |
| 65 | } |
| 66 | |
| 67 | generate_joint_tables(s); |
| 68 | @@ -365,6 +370,7 @@ static int read_old_huffman_tables(HYuvC |
| 69 | #if 1 |
| 70 | GetBitContext gb; |
| 71 | int i; |
| 72 | + int ret; |
| 73 | |
| 74 | init_get_bits(&gb, classic_shift_luma, sizeof(classic_shift_luma)*8); |
| 75 | if(read_len_table(s->len[0], &gb)<0) |
| 76 | @@ -385,7 +391,9 @@ static int read_old_huffman_tables(HYuvC |
| 77 | |
| 78 | for(i=0; i<3; i++){ |
| 79 | free_vlc(&s->vlc[i]); |
| 80 | - init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, s->bits[i], 4, 4, 0); |
| 81 | + if ((ret = init_vlc(&s->vlc[i], VLC_BITS, 256, s->len[i], 1, 1, |
| 82 | + s->bits[i], 4, 4, 0)) < 0) |
| 83 | + return ret; |
| 84 | } |
| 85 | |
| 86 | generate_joint_tables(s); |
| 87 | -- |