apedec: prevent out of array writes in decode_array_0000
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Tue, 28 Apr 2015 09:13:43 +0000 (11:13 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 28 Apr 2015 10:52:02 +0000 (12:52 +0200)
commit60201e27efa6bf98f9dbdf6ea18c3c91183f937f
treeb7c078f8450baf5923eaa06e173d20e573cbfb74
parentbe7dc34bcf00b8c5b6503c600e7f6bc9324801ff
apedec: prevent out of array writes in decode_array_0000

s->decoded_buffer is allocated with a min_size of:
    2 * FFALIGN(blockstodecode, 8) * sizeof(*s->decoded_buffer)

Then it is assigned to s->decoded[0] (and s->decoded_buffer + FFALIGN(blockstodecode, 8)
to s->decoded[1]) and passed as out buffer to decode_array_0000.

In this function 64 elements of the out buffer are written
unconditionally and outside the array if blockstodecode is too small.

This causes memory corruption, leading to segmentation faults or other
crashes.

Thus change decode_array_0000 to write at most blockstodecode elements
of the out buffer.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 699341d647f7af785fb8ceed67604467b0b9ab12)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/apedec.c