← Back to branch summary

~siretart/xine-lib/ubuntu

« back to all changes in this revision

Viewing changes to src/libffmpeg/libavcodec/asv1.c

  • Committer: Bazaar Package Importer
  • Author(s): Martin Pitt
  • Date: 2005-12-15 13:13:45 UTC
  • mfrom: (0.1.2 upstream)
  • Revision ID: james.westby@ubuntu.com-20051215131345-8n4osv1j7fy9c1s1
* SECURITY UPDATE: Fix arbitrary code execution with crafted PNG images in
  embedded ffmpeg copy.
* src/libffmpeg/libavcodec/utils.c, avcodec_default_get_buffer(): Apply
  upstream patch to fix buffer overflow on decoding of small PIX_FMT_PAL8
  PNG files.
* References:
  CVE-2005-4048
  http://mplayerhq.hu/pipermail/ffmpeg-devel/2005-November/005333.html
  http://www1.mplayerhq.hu/cgi-bin/cvsweb.cgi/ffmpeg/libavcodec/
  utils.c.diff?r1=1.161&r2=1.162&cvsroot=FFMpeg

Show diffs side-by-side

added added

removed removed

Lines of Context:
src/libffmpeg/libavcodec/asv1.c
63
63
};
64
64
 
65
65
 
66
 
static const uint8_t reverse[256]={
67
 
0x00,0x80,0x40,0xC0,0x20,0xA0,0x60,0xE0,0x10,0x90,0x50,0xD0,0x30,0xB0,0x70,0xF0,
68
 
0x08,0x88,0x48,0xC8,0x28,0xA8,0x68,0xE8,0x18,0x98,0x58,0xD8,0x38,0xB8,0x78,0xF8,
69
 
0x04,0x84,0x44,0xC4,0x24,0xA4,0x64,0xE4,0x14,0x94,0x54,0xD4,0x34,0xB4,0x74,0xF4,
70
 
0x0C,0x8C,0x4C,0xCC,0x2C,0xAC,0x6C,0xEC,0x1C,0x9C,0x5C,0xDC,0x3C,0xBC,0x7C,0xFC,
71
 
0x02,0x82,0x42,0xC2,0x22,0xA2,0x62,0xE2,0x12,0x92,0x52,0xD2,0x32,0xB2,0x72,0xF2,
72
 
0x0A,0x8A,0x4A,0xCA,0x2A,0xAA,0x6A,0xEA,0x1A,0x9A,0x5A,0xDA,0x3A,0xBA,0x7A,0xFA,
73
 
0x06,0x86,0x46,0xC6,0x26,0xA6,0x66,0xE6,0x16,0x96,0x56,0xD6,0x36,0xB6,0x76,0xF6,
74
 
0x0E,0x8E,0x4E,0xCE,0x2E,0xAE,0x6E,0xEE,0x1E,0x9E,0x5E,0xDE,0x3E,0xBE,0x7E,0xFE,
75
 
0x01,0x81,0x41,0xC1,0x21,0xA1,0x61,0xE1,0x11,0x91,0x51,0xD1,0x31,0xB1,0x71,0xF1,
76
 
0x09,0x89,0x49,0xC9,0x29,0xA9,0x69,0xE9,0x19,0x99,0x59,0xD9,0x39,0xB9,0x79,0xF9,
77
 
0x05,0x85,0x45,0xC5,0x25,0xA5,0x65,0xE5,0x15,0x95,0x55,0xD5,0x35,0xB5,0x75,0xF5,
78
 
0x0D,0x8D,0x4D,0xCD,0x2D,0xAD,0x6D,0xED,0x1D,0x9D,0x5D,0xDD,0x3D,0xBD,0x7D,0xFD,
79
 
0x03,0x83,0x43,0xC3,0x23,0xA3,0x63,0xE3,0x13,0x93,0x53,0xD3,0x33,0xB3,0x73,0xF3,
80
 
0x0B,0x8B,0x4B,0xCB,0x2B,0xAB,0x6B,0xEB,0x1B,0x9B,0x5B,0xDB,0x3B,0xBB,0x7B,0xFB,
81
 
0x07,0x87,0x47,0xC7,0x27,0xA7,0x67,0xE7,0x17,0x97,0x57,0xD7,0x37,0xB7,0x77,0xF7,
82
 
0x0F,0x8F,0x4F,0xCF,0x2F,0xAF,0x6F,0xEF,0x1F,0x9F,0x5F,0xDF,0x3F,0xBF,0x7F,0xFF,
83
 
};
84
 
 
85
66
static const uint8_t ccp_tab[17][2]={
86
67
    {0x2,2}, {0x7,5}, {0xB,5}, {0x3,5},
87
68
    {0xD,5}, {0x5,5}, {0x9,5}, {0x1,5},
137
118
 
138
119
        init_vlc(&ccp_vlc, VLC_BITS, 17, 
139
120
                 &ccp_tab[0][1], 2, 1,
140
 
                 &ccp_tab[0][0], 2, 1);
 
121
                 &ccp_tab[0][0], 2, 1, 1);
141
122
        init_vlc(&dc_ccp_vlc, VLC_BITS, 8, 
142
123
                 &dc_ccp_tab[0][1], 2, 1,
143
 
                 &dc_ccp_tab[0][0], 2, 1);
 
124
                 &dc_ccp_tab[0][0], 2, 1, 1);
144
125
        init_vlc(&ac_ccp_vlc, VLC_BITS, 16, 
145
126
                 &ac_ccp_tab[0][1], 2, 1,
146
 
                 &ac_ccp_tab[0][0], 2, 1);
 
127
                 &ac_ccp_tab[0][0], 2, 1, 1);
147
128
        init_vlc(&level_vlc,  VLC_BITS, 7, 
148
129
                 &level_tab[0][1], 2, 1,
149
 
                 &level_tab[0][0], 2, 1);
 
130
                 &level_tab[0][0], 2, 1, 1);
150
131
        init_vlc(&asv2_level_vlc, ASV2_LEVEL_VLC_BITS, 63, 
151
132
                 &asv2_level_tab[0][1], 2, 1,
152
 
                 &asv2_level_tab[0][0], 2, 1);
 
133
                 &asv2_level_tab[0][0], 2, 1, 1);
153
134
    }
154
135
}
155
136
 
156
137
//FIXME write a reversed bitstream reader to avoid the double reverse
157
138
static inline int asv2_get_bits(GetBitContext *gb, int n){
158
 
    return reverse[ get_bits(gb, n) << (8-n) ];
 
139
    return ff_reverse[ get_bits(gb, n) << (8-n) ];
159
140
}
160
141
 
161
142
static inline void asv2_put_bits(PutBitContext *pb, int n, int v){
162
 
    put_bits(pb, n, reverse[ v << (8-n) ]);
 
143
    put_bits(pb, n, ff_reverse[ v << (8-n) ]);
163
144
}
164
145
 
165
146
static inline int asv1_get_level(GetBitContext *gb){
339
320
    return 0;
340
321
}
341
322
 
342
 
static inline void encode_mb(ASV1Context *a, DCTELEM block[6][64]){
 
323
static inline int encode_mb(ASV1Context *a, DCTELEM block[6][64]){
343
324
    int i;
 
325
    
 
326
    if(a->pb.buf_end - a->pb.buf - (put_bits_count(&a->pb)>>3) < 30*16*16*3/2/8){
 
327
        av_log(a->avctx, AV_LOG_ERROR, "encoded frame too large\n");
 
328
        return -1;
 
329
    }
344
330
 
345
331
    if(a->avctx->codec_id == CODEC_ID_ASV1){
346
332
        for(i=0; i<6; i++)
349
335
        for(i=0; i<6; i++)
350
336
            asv2_encode_block(a, block[i]);
351
337
    }
 
338
    return 0;
352
339
}
353
340
 
354
341
static inline void idct_put(ASV1Context *a, int mb_x, int mb_y){
403
390
    AVFrame * const p= (AVFrame*)&a->picture;
404
391
    int mb_x, mb_y;
405
392
 
406
 
    /* special case for last picture */
407
 
    if (buf_size == 0) {
408
 
        return 0;
409
 
    }
410
 
 
411
393
    if(p->data[0])
412
394
        avctx->release_buffer(avctx, p);
413
395
 
426
408
    else{
427
409
        int i;
428
410
        for(i=0; i<buf_size; i++)
429
 
            a->bitstream_buffer[i]= reverse[ buf[i] ];
 
411
            a->bitstream_buffer[i]= ff_reverse[ buf[i] ];
430
412
    }
431
413
 
432
414
    init_get_bits(&a->gb, a->bitstream_buffer, buf_size*8);
527
509
    else{
528
510
        int i;
529
511
        for(i=0; i<4*size; i++)
530
 
            buf[i]= reverse[ buf[i] ];
 
512
            buf[i]= ff_reverse[ buf[i] ];
531
513
    }
532
514
    
533
515
    return size*4;
556
538
    common_init(avctx);
557
539
    init_vlcs(a);
558
540
    ff_init_scantable(a->dsp.idct_permutation, &a->scantable, scantab);
 
541
    avctx->pix_fmt= PIX_FMT_YUV420P;
559
542
 
560
543
    a->inv_qscale= ((uint8_t*)avctx->extradata)[0];
561
544
    if(a->inv_qscale == 0){
573
556
    }
574
557
 
575
558
    p->qstride= a->mb_width;
576
 
    p->qscale_table= av_mallocz( p->qstride * a->mb_height);
 
559
    p->qscale_table= av_malloc( p->qstride * a->mb_height);
577
560
    p->quality= (32*scale + a->inv_qscale/2)/a->inv_qscale;
578
561
    memset(p->qscale_table, p->quality, p->qstride*a->mb_height);
579
562