wrapper/FFmpeg
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

avformat/movenc: Check pal_size before use

Browse source 
Fixes: assertion failure
Fixes: out of array read
Fixes: Ticket8190
Fixes: CVE-2020-22015

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
(cherry picked from commit 4c1afa2925)
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2021-05-29 09:22:27 +02:00
parent a6dc7ba0ec
commit ef75363a43
1 changed files with 4 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

6
libavformat/movenc.c
View file

@ -1768,11 +1768,13 @@ static int mov_write_video_tag(AVIOContext *pb, MOVMuxContext *mov, MOVTrack *tr
avio_wb16(pb, 0x18); /* Reserved */
if (track->mode == MODE_MOV && track->par->format == AV_PIX_FMT_PAL8) {
int pal_size = 1 << track->par->bits_per_coded_sample;
int i;
int pal_size, i;
avio_wb16(pb, 0); /* Color table ID */
avio_wb32(pb, 0); /* Color table seed */
avio_wb16(pb, 0x8000); /* Color table flags */
if (track->par->bits_per_coded_sample < 0 || track->par->bits_per_coded_sample > 8)
return AVERROR(EINVAL);
pal_size = 1 << track->par->bits_per_coded_sample;
avio_wb16(pb, pal_size - 1); /* Color table size (zero-relative) */
for (i = 0; i < pal_size; i++) {
uint32_t rgb = track->palette[i];