kenmirrors/freeswitch
1
0
Fork 0
mirror of https://github.com/signalwire/freeswitch.git synced 2025-04-14 16:15:04 +00:00
Code Issues Projects Releases Wiki Activity

FS-10997: [libvpx] CVE-2017-13194

Browse Source
This commit is contained in:
Mike Jerris 2018-04-06 15:10:02 -04:00 committed by Muteesa Fred
parent 6ccc96a39c
commit bb92955e21
1 changed files with 16 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
libs/libvpx/vpx/src/vpx_image.c
View File

@ -88,11 +88,10 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
default: ycs = 0; break; default: ycs = 0; break;
} }
/* Calculate storage sizes given the chroma subsampling */ /* Calculate storage sizes. If the buffer was allocated externally, the width
align = (1 << xcs) - 1; * and height shouldn't be adjusted. */
w = (d_w + align) & ~align; w = d_w;
align = (1 << ycs) - 1; h = d_h;
h = (d_h + align) & ~align;
s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8; s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
s = (s + stride_align - 1) & ~(stride_align - 1); s = (s + stride_align - 1) & ~(stride_align - 1);
stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s; stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
@ -111,9 +110,18 @@ static vpx_image_t *img_alloc_helper(vpx_image_t *img, vpx_img_fmt_t fmt,
img->img_data = img_data; img->img_data = img_data;
if (!img_data) { if (!img_data) {
const uint64_t alloc_size = (fmt & VPX_IMG_FMT_PLANAR) uint64_t alloc_size;
? (uint64_t)h * s * bps / 8 /* Calculate storage sizes given the chroma subsampling */
: (uint64_t)h * s; align = (1 << xcs) - 1;
w = (d_w + align) & ~align;
align = (1 << ycs) - 1;
h = (d_h + align) & ~align;
s = (fmt & VPX_IMG_FMT_PLANAR) ? w : bps * w / 8;
s = (s + stride_align - 1) & ~(stride_align - 1);
stride_in_bytes = (fmt & VPX_IMG_FMT_HIGHBITDEPTH) ? s * 2 : s;
alloc_size = (fmt & VPX_IMG_FMT_PLANAR) ? (uint64_t)h * s * bps / 8
: (uint64_t)h * s;
if (alloc_size != (size_t)alloc_size) goto fail; if (alloc_size != (size_t)alloc_size) goto fail;