avcodec/g2meet: check tile dimensions to avoid integer overflow
authorMichael Niedermayer <michaelni@gmx.at>
Thu, 30 Oct 2014 00:19:17 +0000 (01:19 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 30 Oct 2014 00:51:30 +0000 (01:51 +0100)
Fixes out of array access
Fixes: asan_heap-oob_12a55d3_30_029.wmv
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 32e666c354e4a3160d8cf1d303cb51990b095c87)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/g2meet.c

index 1004e19..d0cb88c 100644 (file)
@@ -736,8 +736,10 @@ static int g2m_decode_frame(AVCodecContext *avctx, void *data,
             }
             c->tile_width  = bytestream2_get_be32(&bc);
             c->tile_height = bytestream2_get_be32(&bc);
-            if (!c->tile_width || !c->tile_height ||
-                ((c->tile_width | c->tile_height) & 0xF)) {
+            if (c->tile_width <= 0 || c->tile_height <= 0 ||
+                ((c->tile_width | c->tile_height) & 0xF) ||
+                c->tile_width * 4LL * c->tile_height >= INT_MAX
+            ) {
                 av_log(avctx, AV_LOG_ERROR,
                        "Invalid tile dimensions %dx%d\n",
                        c->tile_width, c->tile_height);