ivi_common: check that scan pattern is set before using it.
authorAnton Khirnov <anton@khirnov.net>
Thu, 13 Dec 2012 18:38:20 +0000 (19:38 +0100)
committerAnton Khirnov <anton@khirnov.net>
Fri, 14 Dec 2012 06:10:53 +0000 (07:10 +0100)
Fixes CVE-2012-2791.

CC: libav-stable@libav.org
libavcodec/ivi_common.c

index 9b81094..76782e5 100644 (file)
@@ -460,6 +460,11 @@ static int ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile
             }
 
             if (cbp & 1) { /* block coded ? */
             }
 
             if (cbp & 1) { /* block coded ? */
+                if (!band->scan) {
+                    av_log(avctx, AV_LOG_ERROR, "Scan pattern is not set.\n");
+                    return AVERROR_INVALIDDATA;
+                }
+
                 scan_pos = -1;
                 memset(trvec, 0, num_coeffs*sizeof(trvec[0])); /* zero transform vector */
                 memset(col_flags, 0, sizeof(col_flags));      /* zero column flags */
                 scan_pos = -1;
                 memset(trvec, 0, num_coeffs*sizeof(trvec[0])); /* zero transform vector */
                 memset(col_flags, 0, sizeof(col_flags));      /* zero column flags */