Andrew Geissler | eff2747 | 2021-10-29 15:35:00 -0500 | [diff] [blame^] | 1 | CVE: CVE-2021-38114 |
| 2 | Upstream-Status: Backport |
| 3 | Signed-off-by: Kiran Surendran <kiran.surendran@windriver.com> |
| 4 | |
| 5 | From 463dbe4e78cc560ca5b09f23a07add0eb78ccee8 Mon Sep 17 00:00:00 2001 |
| 6 | From: maryam ebr <me22bee@outlook.com> |
| 7 | Date: Tue, 3 Aug 2021 01:05:47 -0400 |
| 8 | Subject: [PATCH] avcodec/dnxhddec: check and propagate function return value |
| 9 | |
| 10 | Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed. |
| 11 | crafted DNxHD data can cause unspecified impact. |
| 12 | |
| 13 | Reviewed-by: Paul B Mahol <onemda@gmail.com> |
| 14 | Signed-off-by: James Almer <jamrial@gmail.com> |
| 15 | --- |
| 16 | libavcodec/dnxhddec.c | 22 +++++++++++++++------- |
| 17 | 1 file changed, 15 insertions(+), 7 deletions(-) |
| 18 | |
| 19 | diff --git a/libavcodec/dnxhddec.c b/libavcodec/dnxhddec.c |
| 20 | index c78d55aee5..9b475a6979 100644 |
| 21 | --- a/libavcodec/dnxhddec.c |
| 22 | +++ b/libavcodec/dnxhddec.c |
| 23 | @@ -112,6 +112,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx) |
| 24 | |
| 25 | static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth) |
| 26 | { |
| 27 | + int ret; |
| 28 | if (cid != ctx->cid) { |
| 29 | const CIDEntry *cid_table = ff_dnxhd_get_cid_table(cid); |
| 30 | |
| 31 | @@ -132,19 +133,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth) |
| 32 | ff_free_vlc(&ctx->dc_vlc); |
| 33 | ff_free_vlc(&ctx->run_vlc); |
| 34 | |
| 35 | - init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, |
| 36 | + if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257, |
| 37 | ctx->cid_table->ac_bits, 1, 1, |
| 38 | - ctx->cid_table->ac_codes, 2, 2, 0); |
| 39 | - init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12, |
| 40 | + ctx->cid_table->ac_codes, 2, 2, 0)) < 0) |
| 41 | + goto out; |
| 42 | + if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12, |
| 43 | ctx->cid_table->dc_bits, 1, 1, |
| 44 | - ctx->cid_table->dc_codes, 1, 1, 0); |
| 45 | - init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, |
| 46 | + ctx->cid_table->dc_codes, 1, 1, 0)) < 0) |
| 47 | + goto out; |
| 48 | + if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62, |
| 49 | ctx->cid_table->run_bits, 1, 1, |
| 50 | - ctx->cid_table->run_codes, 2, 2, 0); |
| 51 | + ctx->cid_table->run_codes, 2, 2, 0)) < 0) |
| 52 | + goto out; |
| 53 | |
| 54 | ctx->cid = cid; |
| 55 | } |
| 56 | - return 0; |
| 57 | + ret = 0; |
| 58 | +out: |
| 59 | + if (ret < 0) |
| 60 | + av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n"); |
| 61 | + return ret; |
| 62 | } |
| 63 | |
| 64 | static int dnxhd_get_profile(int cid) |
| 65 | -- |
| 66 | 2.31.1 |
| 67 | |