mythcommflag crash in mpeg2 decoding

[jwestfall@…]

I got a reproducable segfault in a recording attaching gdb output. seems to be buf_ptr > buf_end, results in passing a negative input_size value to mpeg1_decode_picture().

[jwestfall@…]

gdb output

[jwestfall@…]

Hi

I believe the following code in find_start_code() is the culprit.

static int find_start_code(const uint8_t **pbuf_ptr, const uint8_t *buf_end)
{   
    const uint8_t *buf_ptr= *pbuf_ptr;

    buf_ptr++; //gurantees that -1 is within the array
    buf_end -= 2; // gurantees that +2 is within the array

    while (buf_ptr < buf_end) {
        if(*buf_ptr==0){
            while(buf_ptr < buf_end && buf_ptr[1]==0)
                buf_ptr++;

            if(buf_ptr[-1] == 0 && buf_ptr[1] == 1){
                *pbuf_ptr = buf_ptr+3;
                return buf_ptr[2] + 0x100;
            }
        }
        buf_ptr += 2;
    }

If the inner while loop fails because buf_ptr == buf_end, and the following if statement is true, the code will set *pbuf_ptr = buf_ptr+3 which is 1 byte past the real end of the buffer (buf_end+2).

attaching a patch that fixes the issue for me.

[jwestfall@…]

patch that fixes

[Isaac Richards]

(In [8539]) Close #961 by applying patch (off-by one overread in libavcodec).

Jim, you should probably submit this upstream to the ffmpeg people.