avcodec/webp: validate the distance prefix code
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Mon, 2 Mar 2015 19:47:57 +0000 (20:47 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 2 Mar 2015 23:37:36 +0000 (00:37 +0100)
According to the WebP Lossless Bitstream Specification the highest
allowed value for a prefix code is 39.

If prefix_code is too large, the calculated extra_bits has an invalid
value and triggers an assertion in get_bits.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/webp.c

index e0f7239..9549c0e 100644 (file)
@@ -694,6 +694,11 @@ static int decode_entropy_coded_image(WebPContext *s, enum ImageRole role,
                 length = offset + get_bits(&s->gb, extra_bits) + 1;
             }
             prefix_code = huff_reader_get_symbol(&hg[HUFF_IDX_DIST], &s->gb);
+            if (prefix_code > 39) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "distance prefix code too large: %d\n", prefix_code);
+                return AVERROR_INVALIDDATA;
+            }
             if (prefix_code < 4) {
                 distance = prefix_code + 1;
             } else {