1. ffmpeg
  2. Commit e2865d931618deb65659343f185a0f77cf000296
Browse code

avcodec/g2meet: check tile dimensions to avoid integer overflow

Fixes out of array access
Fixes: asan_heap-oob_12a55d3_30_029.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32e666c354e4a3160d8cf1d303cb51990b095c87)

Conflicts:

libavcodec/g2meet.c

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2014/10/30 09:19:17
Showing 1 changed files
libavcodec/g2meet.c
History View file @ e2865d9
... ... 
@@ -716,7 +716,10 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
716 716 
             }
717 717 
             c->tile_width  = bytestream2_get_be32(&bc);
718 718 
             c->tile_height = bytestream2_get_be32(&bc);
719 
-            if (!c->tile_width || !c->tile_height) {
719 
+            if (c->tile_width <= 0 || c->tile_height <= 0 ||
720 
+                ((c->tile_width | c->tile_height) & 0xF) ||
721 
+                c->tile_width * 4LL * c->tile_height >= INT_MAX
722 
+            ) {
720 723 
                 av_log(avctx, AV_LOG_ERROR,
721 724 
                        "Invalid tile dimensions %dx%d\n",
722 725 
                        c->tile_width, c->tile_height);