code.ossystems Code Review - openembedded-core.git/blob

   1 gst-ffmpeg: smackerdec: Check that the last indexes are within the
   2  table.
   3
   4 Fixes CVE-2011-3944
   5
   6 Upstream-Status: Backport
   7
   8 Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
   9 Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
  10 ---
  11  libavcodec/smacker.c |    5 +++++
  12  1 files changed, 5 insertions(+), 0 deletions(-)
  13
  14 diff --git a/libavcodec/smacker.c b/libavcodec/smacker.c
  15 index 30f99b4..2a8bae8 100644
  16 --- a/gst-libs/ext/libav/libavcodec/smacker.c
  17 +++ b/gst-libs/ext/libav/libavcodec/smacker.c
  18 @@ -259,6 +259,11 @@ static int smacker_decode_header_tree(SmackVContext *smk, GetBitContext *gb, int
  19      if(ctx.last[0] == -1) ctx.last[0] = huff.current++;
  20      if(ctx.last[1] == -1) ctx.last[1] = huff.current++;
  21      if(ctx.last[2] == -1) ctx.last[2] = huff.current++;
  22 +    if(huff.current > huff.length){
  23 +        ctx.last[0] = ctx.last[1] = ctx.last[2] = 1;
  24 +        av_log(smk->avctx, AV_LOG_ERROR, "bigtree damaged\n");
  25 +        return -1;
  26 +    }
  27
  28      *recodes = huff.values;
  29
  30 --
  31 1.7.5.4
  32