Skip to content
Permalink
Browse files Browse the repository at this point in the history
avcodec/mpeg4videodec: Check for bitstream end in read_quant_matrix_e…
…xt()

Fixes: out of array read
Fixes: asff-crash-0e53d0dc491dfdd507530b66562812fbd4c36678

Found-by: Paul Ch <paulcher@icloud.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
  • Loading branch information
michaelni committed Jul 4, 2018
1 parent e37741d commit 5aba5b8
Showing 1 changed file with 10 additions and 1 deletion.
11 changes: 10 additions & 1 deletion libavcodec/mpeg4videodec.c
Expand Up @@ -2867,11 +2867,13 @@ static int decode_vop_header(Mpeg4DecContext *ctx, GetBitContext *gb)
return 0;
}

static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
static int read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
{
int i, j, v;

if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
v = get_bits(gb, 8);
Expand All @@ -2882,13 +2884,17 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}

if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* non_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
get_bits(gb, 8);
}
}

if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* chroma_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
v = get_bits(gb, 8);
Expand All @@ -2898,13 +2904,16 @@ static void read_quant_matrix_ext(MpegEncContext *s, GetBitContext *gb)
}

if (get_bits1(gb)) {
if (get_bits_left(gb) < 64*8)
return AVERROR_INVALIDDATA;
/* chroma_non_intra_quantiser_matrix */
for (i = 0; i < 64; i++) {
get_bits(gb, 8);
}
}

next_start_code_studio(gb);
return 0;
}

static void extension_and_user_data(MpegEncContext *s, GetBitContext *gb, int id)
Expand Down

1 comment on commit 5aba5b8

@wqazzz
Copy link

@wqazzz wqazzz commented on 5aba5b8 May 23, 2020

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please sign in to comment.