vqa: check palette chunk size before reading data.

Message ID 20120322192028.3BB785E0B1@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau March 22, 2012, 7:20 p.m.
Module: libav
Branch: master
Commit: 75d7975268394f4f16294b68ec6d6d5ac30da3ac

Author:    Ronald S. Bultje <rsbultje@gmail.com>
Committer: Ronald S. Bultje <rsbultje@gmail.com>
Date:      Wed Mar 21 15:19:31 2012 -0700

vqa: check palette chunk size before reading data.

Prevents overreads beyond buffer boundaries.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org

---

 libavcodec/vqavideo.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

Patch

diff --git a/libavcodec/vqavideo.c b/libavcodec/vqavideo.c
index 2bb9e2f..54699a0 100644
--- a/libavcodec/vqavideo.c
+++ b/libavcodec/vqavideo.c
@@ -396,7 +396,7 @@  static int vqa_decode_chunk(VqaContext *s)
         bytestream2_seek(&s->gb, cpl0_chunk, SEEK_SET);
         chunk_size = bytestream2_get_be32(&s->gb);
         /* sanity check the palette size */
-        if (chunk_size / 3 > 256) {
+        if (chunk_size / 3 > 256 || chunk_size > bytestream2_get_bytes_left(&s->gb)) {
             av_log(s->avctx, AV_LOG_ERROR, "  VQA video: problem: found a palette chunk with %d colors\n",
                 chunk_size / 3);
             return AVERROR_INVALIDDATA;