FFmpeg/libavcodec
Steinar H. Gunderson 08b098169b speedhq: fix out-of-bounds write
Certain alpha run lengths (for SHQ1/SHQ3/SHQ5) could be stored in
both long and short versions, and we would only accept the short version,
returning -1 (invalid code) for the others. This could cause an
out-of-bounds write on malicious input, as discovered by
Andreas Cadhalpun during fuzzing.

Fix by simply allowing both versions, leaving no invalid codes
in the alpha VLC.

Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
2017-02-02 01:12:07 +01:00
..
2016-10-29 20:43:15 +02:00
2016-10-21 23:58:47 +02:00
2017-01-31 10:49:40 +01:00
2017-01-20 13:58:41 +01:00
2016-09-26 21:42:17 +02:00
2016-10-09 20:09:00 +02:00
2016-10-21 23:58:47 +02:00
2016-11-14 00:33:12 +01:00
2016-11-09 21:10:59 +01:00
2016-10-21 23:58:47 +02:00
2017-01-21 18:08:08 +01:00
2017-01-11 16:02:10 +01:00
2016-09-15 21:48:28 +02:00
2016-09-15 21:48:28 +02:00
2016-09-09 16:35:37 +02:00
2016-11-16 02:39:57 +01:00
2016-08-28 11:18:16 +02:00
2016-08-28 11:18:16 +02:00
2016-11-05 18:56:26 +01:00
2017-01-20 13:58:41 +01:00
2016-11-27 14:34:57 +01:00
2016-10-21 23:58:47 +02:00
2016-09-17 13:23:56 +01:00
2016-09-17 13:23:56 +01:00
2016-09-17 13:23:56 +01:00
2016-11-15 22:01:08 +01:00
2017-01-11 16:02:10 +01:00
2017-01-11 16:02:10 +01:00
2016-11-12 01:36:47 +01:00
2016-10-21 23:58:47 +02:00
2017-01-09 18:43:19 +01:00
2017-01-06 22:05:45 +01:00
2017-01-13 21:19:17 +01:00
2016-12-06 13:21:08 -08:00
2016-10-31 19:23:40 +00:00
2016-10-31 19:23:40 +00:00
2016-11-29 11:23:20 +01:00
2017-01-16 10:24:01 +01:00
2017-02-02 01:12:07 +01:00
2017-01-20 13:58:41 +01:00
2017-02-02 01:12:07 +01:00
2017-01-03 00:52:55 +01:00
2017-01-20 13:58:41 +01:00