Revision 047c6ad752386e892afd45fd97214108e303776f authored by Ronald S. Bultje on 10 February 2012, 06:57:01 UTC, committed by Reinhard Tartler on 19 February 2012, 14:41:16 UTC
Conversion of the luma intra prediction mode to one of the constrained ("alzheimer") ones can happen by crafting special bitstreams, causing a crash because we'll call a NULL function pointer for 16x16 block intra prediction, since constrained intra prediction functions are only implemented for chroma (8x8 blocks). Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind CC: libav-stable@libav.org (cherry picked from commit 45b7bd7c53b41bc5ff6fc2158831f2b1b1256113) Signed-off-by: Reinhard Tartler <siretart@tauware.de> (cherry picked from commit 248d4e461578ff327a2fd75fd0db4f38c270918a) Signed-off-by: Reinhard Tartler <siretart@tauware.de>
1 parent 6362264
trasher.c
/*
* Copyright (c) 2007 Michael Niedermayer
*
* This file is part of Libav.
*
* Libav is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) any later version.
*
* Libav is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with Libav; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
*/
#include <stdio.h>
#include <stdlib.h>
#include <inttypes.h>
static uint32_t state;
static uint32_t ran(void){
return state= state*1664525+1013904223;
}
int main(int argc, char** argv)
{
FILE *f;
int count, maxburst, length;
if (argc < 5){
printf("USAGE: trasher <filename> <count> <maxburst> <seed>\n");
return 1;
}
f= fopen(argv[1], "rb+");
if (!f){
perror(argv[1]);
return 2;
}
count= atoi(argv[2]);
maxburst= atoi(argv[3]);
state= atoi(argv[4]);
fseek(f, 0, SEEK_END);
length= ftell(f);
fseek(f, 0, SEEK_SET);
while(count--){
int burst= 1 + ran() * (uint64_t) (abs(maxburst)-1) / UINT32_MAX;
int pos= ran() * (uint64_t) length / UINT32_MAX;
fseek(f, pos, SEEK_SET);
if(maxburst<0) burst= -maxburst;
if(pos + burst > length)
continue;
while(burst--){
int val= ran() * 256ULL / UINT32_MAX;
if(maxburst<0) val=0;
fwrite(&val, 1, 1, f);
}
}
return 0;
}
Computing file changes ...