avcodec/vmnc: Check that rectangles are within the picture
authorMichael Niedermayer <michaelni@gmx.at>
Mon, 20 Jan 2014 17:08:18 +0000 (18:08 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Mon, 20 Jan 2014 17:46:37 +0000 (18:46 +0100)
Prevents out of array accesses with CODEC_FLAG_EMU_EDGE

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/vmnc.c

index 5f91ab1..46bd52e 100644 (file)
@@ -291,6 +291,11 @@ static int decode_hextile(VmncContext *c, uint8_t* dst, GetByteContext *gb,
                         fg = vmnc_get_pixel(gb, bpp, c->bigendian);
                     xy = bytestream2_get_byte(gb);
                     wh = bytestream2_get_byte(gb);
+                    if (   (xy >> 4) + (wh >> 4) + 1 > w - i
+                        || (xy & 0xF) + (wh & 0xF)+1 > h - j) {
+                        av_log(c->avctx, AV_LOG_ERROR, "Rectangle outside picture\n");
+                        return AVERROR_INVALIDDATA;
+                    }
                     paint_rect(dst2, xy >> 4, xy & 0xF,
                                (wh>>4)+1, (wh & 0xF)+1, fg, bpp, stride);
                 }