Backport buffer over-read prevention from dav1d 1.4.3 (#1324)

memorysafety · Jul 18, 2024 · a6a2373 · a6a2373
2 parents f8a015f + ce56fd9
commit a6a2373
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 0 deletions.
diff --git a/tools/input/annexb.rs b/tools/input/annexb.rs
@@ -125,6 +125,9 @@ unsafe fn parse_obu_header(
     buf = buf.offset(1);
     buf_size -= 1;
     if extension_flag != 0 {
+        if buf_size == 0 {
+            return -1;
+        }
         buf = buf.offset(1);
         buf_size -= 1;
     }

diff --git a/tools/input/parse.h b/tools/input/parse.h
@@ -89,6 +89,8 @@ static inline int parse_obu_header(const uint8_t *buf, int buf_size,
     buf_size--;
 
     if (extension_flag) {
+        if (!buf_size)
+            return -1;
         buf++;
         buf_size--;
         // ignore fields

diff --git a/tools/input/section5.rs b/tools/input/section5.rs
@@ -103,6 +103,9 @@ unsafe fn parse_obu_header(
     buf = buf.offset(1);
     buf_size -= 1;
     if extension_flag != 0 {
+        if buf_size == 0 {
+            return -1;
+        }
         buf = buf.offset(1);
         buf_size -= 1;
     }