vqa: check palette chunk size before reading data.
authorRonald S. Bultje <rsbultje@gmail.com>
Wed, 21 Mar 2012 22:19:31 +0000 (15:19 -0700)
committerReinhard Tartler <siretart@tauware.de>
Sun, 29 Apr 2012 20:07:01 +0000 (22:07 +0200)
Prevents overreads beyond buffer boundaries.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit 75d7975268394f4f16294b68ec6d6d5ac30da3ac)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
libavcodec/vqavideo.c

index 9801167..bc1ff27 100644 (file)
@@ -385,7 +385,7 @@ static int vqa_decode_chunk(VqaContext *s)
         bytestream2_seek(&s->gb, cpl0_chunk, SEEK_SET);
         chunk_size = bytestream2_get_be32(&s->gb);
         /* sanity check the palette size */
-        if (chunk_size / 3 > 256) {
+        if (chunk_size / 3 > 256 || chunk_size > bytestream2_get_bytes_left(&s->gb)) {
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found a palette chunk with %d colors\n",
                 chunk_size / 3);
             return AVERROR_INVALIDDATA;