From 4c1afa292520329eecd1cc7631bc59a8cca95c46 Mon Sep 17 00:00:00 2001
|
From: Michael Niedermayer <michael@niedermayer.cc>
|
Date: Sat, 29 May 2021 09:22:27 +0200
|
Subject: [PATCH] avformat/movenc: Check pal_size before use
|
|
Fixes: assertion failure
|
Fixes: out of array read
|
Fixes: Ticket8190
|
Fixes: CVE-2020-22015
|
|
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
|
|
|
CVE: CVE-2020-22015
|
Upstream-Status: Backport [4c1afa292520329eecd1cc7631bc59a8cca95c46]
|
|
Signed-off-by: Tony Tascioglu <tony.tascioglu@windriver.com>
|
---
|
libavformat/movenc.c | 6 ++++--
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
|
diff --git a/libavformat/movenc.c b/libavformat/movenc.c
|
index 2ab507df15..7d839f447b 100644
|
--- a/libavformat/movenc.c
|
+++ b/libavformat/movenc.c
|
@@ -2160,11 +2160,13 @@ static int mov_write_video_tag(AVFormatContext *s, AVIOContext *pb, MOVMuxContex
|
avio_wb16(pb, 0x18); /* Reserved */
|
|
if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) {
|
- int pal_size = 1 << track->par->bits_per_coded_sample;
|
- int i;
|
+ int pal_size, i;
|
avio_wb16(pb, 0); /* Color table ID */
|
avio_wb32(pb, 0); /* Color table seed */
|
avio_wb16(pb, 0x8000); /* Color table flags */
|
+ if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8)
|
+ return AVERROR(EINVAL);
|
+ pal_size = 1 << track->par->bits_per_coded_sample;
|
avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */
|
for (i = 0; i < pal_size; i++) {
|
uint32_t rgb = track->palette[i];
|
--
|
2.32.0
|
