diff options
author | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2004-12-15 18:52:38 +0000 |
---|---|---|
committer | reimar <reimar@b3059339-0415-0410-9bf9-f77b7e298cf2> | 2004-12-15 18:52:38 +0000 |
commit | abeda3fcbc265d0368a3cb0d8f3269ef54f4377e (patch) | |
tree | 8a8cd3c5fe0640007f62a367760dfc8ce676a2c8 /libmpdemux | |
parent | 22d8dd7d32bbb85a23ef3e888e7f014299931ca2 (diff) |
fix a vulnerability reported by iDEFENSE.
Just for sake of completeness and in case somebody really needs it.
git-svn-id: svn://svn.mplayerhq.hu/mplayer/trunk@14162 b3059339-0415-0410-9bf9-f77b7e298cf2
Diffstat (limited to 'libmpdemux')
-rw-r--r-- | libmpdemux/demux_bmp.c | 20 |
1 files changed, 17 insertions, 3 deletions
diff --git a/libmpdemux/demux_bmp.c b/libmpdemux/demux_bmp.c index 7ec2e6c973..4a0d20a9ba 100644 --- a/libmpdemux/demux_bmp.c +++ b/libmpdemux/demux_bmp.c @@ -15,6 +15,9 @@ #include "demuxer.h" #include "stheader.h" +//! palettes with more than 256 colors are not supported anyway +#define MAX_PALETTE 256 + typedef struct { int image_size; int image_offset; @@ -71,7 +74,9 @@ demuxer_t* demux_open_bmp(demuxer_t* demuxer) // load the BITMAPINFOHEADER // allocate size and take the palette table into account - sh_video->bih = (BITMAPINFOHEADER *)malloc(data_offset - 12); + // due to security considerations, the memory for the palette + // is allocate after all other data is known + sh_video->bih = (BITMAPINFOHEADER *)malloc(sizeof(BITMAPINFOHEADER)); sh_video->bih->biSize = stream_read_dword_le(demuxer->stream); sh_video->bih->biWidth = stream_read_dword_le(demuxer->stream); sh_video->bih->biHeight = stream_read_dword_le(demuxer->stream); @@ -83,9 +88,18 @@ demuxer_t* demux_open_bmp(demuxer_t* demuxer) sh_video->bih->biYPelsPerMeter = stream_read_dword_le(demuxer->stream); sh_video->bih->biClrUsed = stream_read_dword_le(demuxer->stream); sh_video->bih->biClrImportant = stream_read_dword_le(demuxer->stream); + + if (sh_video->bih->biClrUsed > MAX_PALETTE) { + mp_msg(MSGT_DEMUX, MSGL_WARN, "bmp palette contains more than %d colors " + "(%d) which is not supported\n", MAX_PALETTE, + sh_video->bih->biClrUsed); + sh_video->bih->biClrUsed = MAX_PALETTE; + } + sh_video->bih = realloc(sh_video->bih, sizeof(BITMAPINFOHEADER) + + sh_video->bih->biClrUsed * 4); // fetch the palette - stream_read(demuxer->stream, (unsigned char *)(sh_video->bih) + 40, - sh_video->bih->biClrUsed * 4); + stream_read(demuxer->stream, (unsigned char *)(sh_video->bih) + + sizeof(BITMAPINFOHEADER), sh_video->bih->biClrUsed * 4); // load the data bmp_image = (bmp_image_t *)malloc(sizeof(bmp_image_t)); |