Commit d7e6e4af authored by Rafaël Carré's avatar Rafaël Carré

cinepak: do not access arrays beyond allocated size

reported by Drew Yao
parent 6db7a77a
...@@ -63,8 +63,8 @@ typedef struct ...@@ -63,8 +63,8 @@ typedef struct
{ {
int b_grayscale; /* force to grayscale */ int b_grayscale; /* force to grayscale */
int i_width; unsigned int i_width;
int i_height; unsigned int i_height;
int i_stride_x; int i_stride_x;
int i_stride_y; int i_stride_y;
...@@ -93,7 +93,7 @@ struct decoder_sys_t ...@@ -93,7 +93,7 @@ struct decoder_sys_t
static picture_t *DecodeBlock ( decoder_t *, block_t ** ); static picture_t *DecodeBlock ( decoder_t *, block_t ** );
static int cinepak_decode_frame( cinepak_context_t *, int, uint8_t * ); static int cinepak_decode_frame( cinepak_context_t *, size_t, uint8_t * );
/***************************************************************************** /*****************************************************************************
* OpenDecoder: probe the decoder and return score * OpenDecoder: probe the decoder and return score
...@@ -281,6 +281,16 @@ static void cinepak_Getv4( cinepak_context_t *p_context, ...@@ -281,6 +281,16 @@ static void cinepak_Getv4( cinepak_context_t *p_context,
uint8_t i_index[4]; uint8_t i_index[4];
int i,j; int i,j;
size_t y_max = p_context->i_stride[0] * ( i_y + 5 ) + i_x + 5;
size_t u_max = p_context->i_stride[1] * ( ( i_y/2 ) + 2 ) + 2 + ( i_x / 2 );
size_t v_max = p_context->i_stride[2] * ( ( i_y/2 ) + 2 ) + 2 + ( i_x / 2 );
size_t y_siz = p_context->i_stride[0] * p_context->i_lines[0];
size_t u_siz = p_context->i_stride[1] * p_context->i_lines[1];
size_t v_siz = p_context->i_stride[2] * p_context->i_lines[2];
/* boundary check */
if( y_max >= y_siz || u_max >= u_siz || v_max >= v_siz )
return;
uint8_t *p_dst_y, *p_dst_u, *p_dst_v; uint8_t *p_dst_y, *p_dst_u, *p_dst_v;
#define PIX_SET_Y( x, y, v ) \ #define PIX_SET_Y( x, y, v ) \
p_dst_y[(x) + (y)* p_context->i_stride[0]] = (v); p_dst_y[(x) + (y)* p_context->i_stride[0]] = (v);
...@@ -328,6 +338,16 @@ static void cinepak_Getv1( cinepak_context_t *p_context, ...@@ -328,6 +338,16 @@ static void cinepak_Getv1( cinepak_context_t *p_context,
uint8_t i_index; uint8_t i_index;
int i,j; int i,j;
size_t y_max = p_context->i_stride[0] * ( i_y + 5 ) + i_x + 5;
size_t u_max = p_context->i_stride[1] * ( ( i_y/2 ) + 2 ) + 2 + ( i_x / 2 );
size_t v_max = p_context->i_stride[2] * ( ( i_y/2 ) + 2 ) + 2 + ( i_x / 2 );
size_t y_siz = p_context->i_stride[0] * p_context->i_lines[0];
size_t u_siz = p_context->i_stride[1] * p_context->i_lines[1];
size_t v_siz = p_context->i_stride[2] * p_context->i_lines[2];
/* boundary check */
if( y_max >= y_siz || u_max >= u_siz || v_max >= v_siz )
return;
uint8_t *p_dst_y, *p_dst_u, *p_dst_v; uint8_t *p_dst_y, *p_dst_u, *p_dst_v;
#define PIX_SET_Y( x, y, v ) \ #define PIX_SET_Y( x, y, v ) \
p_dst_y[(x) + (y)* p_context->i_stride[0]] = (v); p_dst_y[(x) + (y)* p_context->i_stride[0]] = (v);
...@@ -370,14 +390,14 @@ static void cinepak_Getv1( cinepak_context_t *p_context, ...@@ -370,14 +390,14 @@ static void cinepak_Getv1( cinepak_context_t *p_context,
* The function that decode one frame * The function that decode one frame
*****************************************************************************/ *****************************************************************************/
static int cinepak_decode_frame( cinepak_context_t *p_context, static int cinepak_decode_frame( cinepak_context_t *p_context,
int i_length, uint8_t *p_data ) size_t i_length, uint8_t *p_data )
{ {
int i_strip; int i_strip;
int i_frame_flags; int8_t i_frame_flags;
int i_frame_size; uint32_t i_frame_size;
int i_width, i_height; uint16_t i_width, i_height;
int i_frame_strips; uint16_t i_frame_strips;
int i_index; int i_index;
int i_strip_x1 =0, i_strip_y1=0; int i_strip_x1 =0, i_strip_y1=0;
int i_strip_x2 =0, i_strip_y2=0; int i_strip_x2 =0, i_strip_y2=0;
...@@ -447,15 +467,15 @@ static int cinepak_decode_frame( cinepak_context_t *p_context, ...@@ -447,15 +467,15 @@ static int cinepak_decode_frame( cinepak_context_t *p_context,
/* Now decode each strip */ /* Now decode each strip */
for( i_strip = 0; i_strip < i_frame_strips; i_strip++ ) for( i_strip = 0; i_strip < i_frame_strips; i_strip++ )
{ {
int i_strip_id; uint16_t i_strip_size;
int i_strip_size;
if( i_length <= 12 ) if( i_length <= 12 )
{ {
break; break;
} }
i_strip_id = GET2BYTES( p_data ); p_data += 2; /* int16_t i_strip_id = GET2BYTES( p_data ); */
i_strip_size = GET2BYTES( p_data ); i_strip_size = GET2BYTES( p_data );
i_strip_size = __MIN( i_strip_size, i_length ); i_strip_size = __MIN( i_strip_size, i_length );
/* FIXME I don't really understand how it works; */ /* FIXME I don't really understand how it works; */
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment