[Helix-client-dev] CR: fix for 259105 and 259106 - crashes/potential security issues

These are both the result of the same problem. We're writing past the end of an array due to bogus input data.

Here's the fix (in datatype-restricted\rm\video\codec\rv1dec\decoder\getpic.c):

Index: getpic.c
===================================================================
RCS file: /cvsroot/rarvcode-video/codec/rv1dec/decoder/getpic.c,v
retrieving revision 1.3
diff -u -w -r1.3 getpic.c
--- getpic.c          2 Nov 2004 22:53:50 -0000            1.3
+++ getpic.c       8 Apr 2010 20:35:14 -0000
@@ -546,6 +546,10 @@
         }


+        // prevent writing past the end of the array
+        if ((ypos+1) >= mb_height || (xpos+1) >= mb_width)
+            return CORRUPTED_BITSTREAM;
+
                    /* Store Mode*/
                                imageInfo->modemap[ypos+1][xpos+1] = Mode;

_______________________________________________
Helix-client-dev mailing list
[email protected]
http://lists.helixcommunity.org/mailman/listinfo/helix-client-dev