[FFmpeg-cvslog] indeo4/5: check empty tile size in decode_mb_info().

[Anton Khirnov]

ffmpeg | branch: release/0.7 | Anton Khirnov <anton at khirnov.net> | Sat Sep 29 11:07:58 2012 +0200| [440e98574bde9ca606dfea60c7dda8de555067f7] | committer: Reinhard Tartler

indeo4/5: check empty tile size in decode_mb_info().

This prevents writing into a too small array if some parameters changed
without the tile being reallocated.

Based on a patch by Michael Niedermayer <michaelni at gmx.at>

Fixes CVE-2012-2800

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
(cherry picked from commit ae3da0ae5550053583a6f281ea7fd940497ea0d1)

Conflicts:

	libavcodec/ivi_common.c

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=440e98574bde9ca606dfea60c7dda8de555067f7
---

 libavcodec/indeo5.c     |    4 +++-
 libavcodec/ivi_common.c |   11 ++++++++++-
 libavcodec/ivi_common.h |    2 +-
 3 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/libavcodec/indeo5.c b/libavcodec/indeo5.c
index bb491fe..45460a4 100644
--- a/libavcodec/indeo5.c
+++ b/libavcodec/indeo5.c
@@ -619,8 +619,10 @@ static int decode_band(IVI5DecContext *ctx, int plane_num,
 
         tile->is_empty = get_bits1(&ctx->gb);
         if (tile->is_empty) {
-            ff_ivi_process_empty_tile(avctx, band, tile,
+            result = ff_ivi_process_empty_tile(avctx, band, tile,
                                       (ctx->planes[0].bands[0].mb_size >> 3) - (band->mb_size >> 3));
+            if (result < 0)
+                break;
         } else {
             tile->data_size = ff_ivi_dec_tile_data_size(&ctx->gb);
 
diff --git a/libavcodec/ivi_common.c b/libavcodec/ivi_common.c
index f55371c..38cb3a8 100644
--- a/libavcodec/ivi_common.c
+++ b/libavcodec/ivi_common.c
@@ -495,7 +495,7 @@ int ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile)
     return 0;
 }
 
-void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
+int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
                                IVITile *tile, int32_t mv_scale)
 {
     int             x, y, need_mc, mbn, blk, num_blocks, mv_x, mv_y, mc_type;
@@ -506,6 +506,13 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
     void (*mc_no_delta_func)(int16_t *buf, const int16_t *ref_buf, uint32_t pitch,
                              int mc_type);
 
+    if (tile->num_MBs != IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size)) {
+        av_log(avctx, AV_LOG_ERROR, "Allocated tile size %d mismatches "
+               "parameters %d in ivi_process_empty_tile()\n",
+               tile->num_MBs, IVI_MBs_PER_TILE(tile->width, tile->height, band->mb_size));
+        return AVERROR_INVALIDDATA;
+    }
+
     offs       = tile->ypos * band->pitch + tile->xpos;
     mb         = tile->mbs;
     ref_mb     = tile->ref_mbs;
@@ -586,6 +593,8 @@ void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
             dst += band->pitch;
         }
     }
+
+    return 0;
 }
 
 
diff --git a/libavcodec/ivi_common.h b/libavcodec/ivi_common.h
index cd9847d..3a328c4 100644
--- a/libavcodec/ivi_common.h
+++ b/libavcodec/ivi_common.h
@@ -325,7 +325,7 @@ int  ff_ivi_decode_blocks(GetBitContext *gb, IVIBandDesc *band, IVITile *tile);
  *  @param[in]  tile      pointer to the tile descriptor
  *  @param[in]  mv_scale  scaling factor for motion vectors
  */
-void ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
+int ff_ivi_process_empty_tile(AVCodecContext *avctx, IVIBandDesc *band,
                                IVITile *tile, int32_t mv_scale);
 
 /**