qpeg: fix an off by 1 error in the MV check
diff mbox

Message ID 20161124222952.C01C65DACC@aruru.libav.org
State New
Headers show

Commit Message

Janne Grunau Nov. 24, 2016, 10:29 p.m. 
Module: libav
Branch: master
Commit: bba9d8bdfb208b0ec2ccf182530347151ee3528b

Author:    Anton Khirnov <anton@khirnov.net>
Committer: Anton Khirnov <anton@khirnov.net>
Date:      Sun Aug 14 10:18:39 2016 +0200

qpeg: fix an off by 1 error in the MV check

height - me_y is the line from which we read, so it must be strictly
smaller than the frame height. Fixes possible invalid reads in corrupted
files.

Also, use a proper context for logging the error.

CC: libav-stable@libav.org
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind

---

 libavcodec/qpeg.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch
diff mbox 

diff --git a/libavcodec/qpeg.c b/libavcodec/qpeg.c
index f549cd5..3a2e56c 100644
--- a/libavcodec/qpeg.c
+++ b/libavcodec/qpeg.c
@@ -161,9 +161,9 @@  static void qpeg_decode_inter(QpegContext *qctx, uint8_t *dst,
 
                     /* check motion vector */
                     if ((me_x + filled < 0) || (me_x + me_w + filled > width) ||
-                       (height - me_y - me_h < 0) || (height - me_y > orig_height) ||
+                       (height - me_y - me_h < 0) || (height - me_y >= orig_height) ||
                        (filled + me_w > width) || (height - me_h < 0))
-                        av_log(NULL, AV_LOG_ERROR, "Bogus motion vector (%i,%i), block size %ix%i at %i,%i\n",
+                        av_log(qctx->avctx, AV_LOG_ERROR, "Bogus motion vector (%i,%i), block size %ix%i at %i,%i\n",
                                me_x, me_y, me_w, me_h, filled, height);
                     else {
                         /* do motion compensation */