Skip to content

Commit 7150f95

Browse files
maryam ebrjamrial
maryam ebr
authored andcommitted
avcodec/dnxhddec: check and propagate function return value
Similar to CVE-2013-0868, here return value check for 'init_vlc' is needed. crafted DNxHD data can cause unspecified impact. Reviewed-by: Paul B Mahol <onemda@gmail.com> Signed-off-by: James Almer <jamrial@gmail.com>
1 parent c8b1f2b commit 7150f95

File tree

1 file changed

+15
-7
lines changed

1 file changed

+15
-7
lines changed

Diff for: libavcodec/dnxhddec.c

+15-7
Original file line numberDiff line numberDiff line change
@@ -112,6 +112,7 @@ static av_cold int dnxhd_decode_init(AVCodecContext *avctx)
112112

113113
static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
114114
{
115+
int ret;
115116
if (cid != ctx->cid) {
116117
const CIDEntry *cid_table = ff_dnxhd_get_cid_table(cid);
117118

@@ -132,19 +133,26 @@ static int dnxhd_init_vlc(DNXHDContext *ctx, uint32_t cid, int bitdepth)
132133
ff_free_vlc(&ctx->dc_vlc);
133134
ff_free_vlc(&ctx->run_vlc);
134135

135-
init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
136+
if ((ret = init_vlc(&ctx->ac_vlc, DNXHD_VLC_BITS, 257,
136137
ctx->cid_table->ac_bits, 1, 1,
137-
ctx->cid_table->ac_codes, 2, 2, 0);
138-
init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
138+
ctx->cid_table->ac_codes, 2, 2, 0)) < 0)
139+
goto out;
140+
if ((ret = init_vlc(&ctx->dc_vlc, DNXHD_DC_VLC_BITS, bitdepth > 8 ? 14 : 12,
139141
ctx->cid_table->dc_bits, 1, 1,
140-
ctx->cid_table->dc_codes, 1, 1, 0);
141-
init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
142+
ctx->cid_table->dc_codes, 1, 1, 0)) < 0)
143+
goto out;
144+
if ((ret = init_vlc(&ctx->run_vlc, DNXHD_VLC_BITS, 62,
142145
ctx->cid_table->run_bits, 1, 1,
143-
ctx->cid_table->run_codes, 2, 2, 0);
146+
ctx->cid_table->run_codes, 2, 2, 0)) < 0)
147+
goto out;
144148

145149
ctx->cid = cid;
146150
}
147-
return 0;
151+
ret = 0;
152+
out:
153+
if (ret < 0)
154+
av_log(ctx->avctx, AV_LOG_ERROR, "init_vlc failed\n");
155+
return ret;
148156
}
149157

150158
static int dnxhd_get_profile(int cid)

0 commit comments

Comments
 (0)