shorten: validate block size
authorJustin Ruggles <justin.ruggles@gmail.com>
Fri, 16 Sep 2011 19:31:31 +0000 (15:31 -0400)
committerJustin Ruggles <justin.ruggles@gmail.com>
Thu, 20 Oct 2011 17:09:25 +0000 (13:09 -0400)
libavcodec/shorten.c

index 2502587..3f06e57 100644 (file)
@@ -330,8 +330,16 @@ static int read_header(ShortenContext *s)
 
     /* get blocksize if version > 0 */
     if (s->version > 0) {
 
     /* get blocksize if version > 0 */
     if (s->version > 0) {
-        int skip_bytes;
-        s->blocksize = get_uint(s, av_log2(DEFAULT_BLOCK_SIZE));
+        int skip_bytes, blocksize;
+
+        blocksize = get_uint(s, av_log2(DEFAULT_BLOCK_SIZE));
+        if (!blocksize || blocksize > MAX_BLOCKSIZE) {
+            av_log(s->avctx, AV_LOG_ERROR, "invalid or unsupported block size: %d\n",
+                   blocksize);
+            return AVERROR(EINVAL);
+        }
+        s->blocksize = blocksize;
+
         maxnlpc = get_uint(s, LPCQSIZE);
         s->nmean = get_uint(s, 0);
 
         maxnlpc = get_uint(s, LPCQSIZE);
         s->nmean = get_uint(s, 0);
 
@@ -456,6 +464,11 @@ static int shorten_decode_frame(AVCodecContext *avctx,
                         av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\n");
                         return AVERROR_PATCHWELCOME;
                     }
                         av_log(avctx, AV_LOG_ERROR, "Increasing block size is not supported\n");
                         return AVERROR_PATCHWELCOME;
                     }
+                    if (!blocksize || blocksize > MAX_BLOCKSIZE) {
+                        av_log(avctx, AV_LOG_ERROR, "invalid or unsupported "
+                               "block size: %d\n", blocksize);
+                        return AVERROR(EINVAL);
+                    }
                     s->blocksize = blocksize;
                     break;
                 }
                     s->blocksize = blocksize;
                     break;
                 }