Attachment 12513 Details for Bug 28504 – prevent gif crash

[patch] prevent gif crash

mplayer-r37857-gif-crash.patch (text/plain), 799 bytes, created by Philippe Didier on 2021-03-25 01:49:45 CET

(hide)

Description:

Filename:

MIME Type:

Creator: Philippe Didier

Created: 2021-03-25 01:49:45 CET

Size: 799 bytes

patch

obsolete

Modified: trunk/libmpdemux/demux_gif.c
==============================================================================
--- trunk/libmpdemux/demux_gif.c	Sat Apr 16 11:43:19 2016	(r37856)
+++ trunk/libmpdemux/demux_gif.c	Thu Apr 28 23:32:40 2016	(r37857)
@@ -304,6 +304,17 @@ static demuxer_t* demux_open_gif(demuxer
     return NULL;
   }
 
+  // Validate image size, most code in this demuxer assumes w*h <= INT_MAX
+  if ((int64_t)gif->SWidth * gif->SHeight > INT_MAX) {
+    mp_msg(MSGT_DEMUX, MSGL_ERR,
+           "[demux_gif] Unsupported picture size %dx%d.\n", gif->SWidth,
+           gif->SHeight);
+    if (DGifCloseFile(gif) == GIF_ERROR)
+      print_gif_error(NULL);
+    free(priv);
+    return NULL;
+  }
+
   // create a new video stream header
   sh_video = new_sh_video(demuxer, 0);

Actions: View | Diff

Attachments on bug 28504: 12499 | 12500 | 12501 | 12502 | 12503 | 12504 | 12505 | 12506 | 12507 | 12508 | 12509 | 12510 | 12511 | 12512 | 12513 | 12514 | 12515 | 12518 | 12536 | 12541