4xm: check bitstream_size boundary before using it
authorLuca Barbato <lu_zero@gentoo.org>
Mon, 10 Jun 2013 14:37:43 +0000 (16:37 +0200)
committerReinhard Tartler <siretart@tauware.de>
Sun, 30 Jun 2013 14:25:06 +0000 (16:25 +0200)
Prevent buffer overread.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 59d7bb99b6a963b7e11c637228b2203adf535eee)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/4xm.c

libavcodec/4xm.c

index 842e787..e9f08c3 100644 (file)
@@ -663,6 +663,9 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
     unsigned int prestream_size;
     const uint8_t *prestream;
 
+    if (bitstream_size > (1 << 26))
+        return AVERROR_INVALIDDATA;
+
     if (length < bitstream_size + 12) {
         av_log(f->avctx, AV_LOG_ERROR, "packet size too small\n");
         return AVERROR_INVALIDDATA;
@@ -673,7 +676,6 @@ static int decode_i_frame(FourXContext *f, const uint8_t *buf, int length){
     prestream      = buf + bitstream_size + 12;
 
     if(prestream_size + bitstream_size + 12 != length
-       || bitstream_size > (1<<26)
        || prestream_size > (1<<26)){
         av_log(f->avctx, AV_LOG_ERROR, "size mismatch %d %d %d\n", prestream_size, bitstream_size, length);
         return -1;