Changeset 6038

Timestamp:

Jul 14, 2019 5:21:16 PM (5 years ago)

Author:

ming

Message:

Fixed #2212: Fix potential buffer overflow in Video Toolbox codec

File:

• pjproject/trunk/pjmedia/src/pjmedia-codec/vid_toolbox.m (modified) (2 diffs)

pjproject/trunk/pjmedia/src/pjmedia-codec/vid_toolbox.m

@@ -22 +22 @@
 #include <pjmedia/errno.h>
 #include <pj/log.h>
+#include <pj/math.h>
 
 #if defined(PJMEDIA_HAS_VID_TOOLBOX_CODEC) && \
@@ -1229 +1230 @@
         if (nalu_type == 7) {
             /* NALU type 7 is the SPS parameter NALU */
-            vtool_data->dec_sps_size = frm_size - code_size;
+            vtool_data->dec_sps_size = PJ_MIN(frm_size - code_size,
+                                              sizeof(vtool_data->dec_sps));
             pj_memcpy(vtool_data->dec_sps, &start[code_size],
                       vtool_data->dec_sps_size);
         } else if (nalu_type == 8) {
             /* NALU type 8 is the PPS parameter NALU */
-            vtool_data->dec_pps_size = frm_size - code_size;
+            vtool_data->dec_pps_size = PJ_MIN(frm_size - code_size,
+                                              sizeof(vtool_data->dec_pps));
             pj_memcpy(vtool_data->dec_pps, &start[code_size],
                       vtool_data->dec_pps_size);