[FFmpeg-devel] [PATCH] Do not read beyond input in EA-TGV

Peter Ross pross
Fri Feb 26 08:13:15 CET 2010


On Fri, Feb 19, 2010 at 06:20:51PM +0100, Vitor Sessak wrote:
> $subj, as now result of FATE test #362 depends on uninitialized memory.
> 
> -Vitor

> Index: libavcodec/eatgv.c
> ===================================================================
> --- libavcodec/eatgv.c	(revision 21872)
> +++ libavcodec/eatgv.c	(working copy)
> @@ -192,6 +192,10 @@
>              s->block_codebook[i][15-j] = tmp[get_bits(&gb, 2)];
>      }
>  
> +    if (get_bits_left(&gb) < vector_bits *
> +        (s->avctx->height/4) * (s->avctx->width/4))
> +        return -1;
> +
>      /* read vectors and build frame */
>      for(y=0; y<s->avctx->height/4; y++)
>      for(x=0; x<s->avctx->width/4; x++) {

Ok.

-- Peter
(A907 E02F A6E5 0CD2 34CD 20D2 6760 79C5 AC40 DD6B)
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 189 bytes
Desc: Digital signature
URL: <http://lists.mplayerhq.hu/pipermail/ffmpeg-devel/attachments/20100226/345c05b2/attachment.pgp>



More information about the ffmpeg-devel mailing list