Fix heap overflows in CDG decoder
authorDan Rosenberg <drosenberg@vsecurity.com>
Fri, 7 Jan 2011 16:06:08 +0000 (11:06 -0500)
committerRémi Denis-Courmont <remi@remlab.net>
Tue, 11 Jan 2011 18:17:02 +0000 (20:17 +0200)
commitf9b664eac0e1a7bceed9d7b5854fd9fc351b4aab
tree6bb97bd8c0f6a2d85326b96135e0df47f5afd08b
parent219c6239f61bfb106f5f5fcbb85946a58661b800
Fix heap overflows in CDG decoder

This patch resolves two heap corruption vulnerabilities in the CDG
decoder for VLC media player.  In both cases, a failure to properly
validate indexes into statically-sized arrays on the heap could allow a
maliciously crafted CDG video to corrupt the heap in a controlled
manner, potentially leading to code execution.

The patch is against v1.1.5 from vlc git, but this decoder hasn't been
touched in awhile, so I'd expect it to cleanly apply to older versions.
I've tested it and confirmed it resolves the heap corruption issues and
does not break functionality.

(...)

Signed-off-by: Rémi Denis-Courmont <remi@remlab.net>
modules/codec/cdg.c