[vlc-commits] video_filter/blendbench: fix out-of-bound reads on ill-formed parameters

[Filip Roséen]

vlc | branch: master | Filip Roséen <filip at atch.se> | Wed Mar 22 04:40:08 2017 +0100| [8a054e3c4f93ba1b8614da141a4633ad65c641f3] | committer: Rémi Denis-Courmont

video_filter/blendbench: fix out-of-bound reads on ill-formed parameters

Prevent out-of-bounds access if --blendbench-base-chroma or
--blendbench-blend-chroma is ill-formed.

refs: #18116
fixes: #18146

Signed-off-by: Rémi Denis-Courmont <remi at remlab.net>

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=8a054e3c4f93ba1b8614da141a4633ad65c641f3
---

 modules/video_filter/blendbench.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/video_filter/blendbench.c b/modules/video_filter/blendbench.c
index 5f42436..d33fc3c 100644
--- a/modules/video_filter/blendbench.c
+++ b/modules/video_filter/blendbench.c
@@ -177,8 +177,8 @@ static int Create( vlc_object_t *p_this )
                                                   CFG_PREFIX "alpha" );
 
     psz_temp = var_CreateGetStringCommand( p_filter, CFG_PREFIX "base-chroma" );
-    p_sys->i_base_chroma = VLC_FOURCC( psz_temp[0], psz_temp[1],
-                                       psz_temp[2], psz_temp[3] );
+    p_sys->i_base_chroma = !psz_temp || strlen( psz_temp ) != 4 ? 0 :
+        VLC_FOURCC( psz_temp[0], psz_temp[1], psz_temp[2], psz_temp[3] );
     psz_cmd = var_CreateGetStringCommand( p_filter, CFG_PREFIX "base-image" );
     i_ret = blendbench_LoadImage( p_this, &p_sys->p_base_image,
                                   p_sys->i_base_chroma, psz_cmd, "Base" );
@@ -192,8 +192,8 @@ static int Create( vlc_object_t *p_this )
 
     psz_temp = var_CreateGetStringCommand( p_filter,
                                            CFG_PREFIX "blend-chroma" );
-    p_sys->i_blend_chroma = VLC_FOURCC( psz_temp[0], psz_temp[1],
-                                        psz_temp[2], psz_temp[3] );
+    p_sys->i_blend_chroma = !psz_temp || strlen( psz_temp ) != 4
+        ? 0 : VLC_FOURCC( psz_temp[0], psz_temp[1], psz_temp[2], psz_temp[3] );
     psz_cmd = var_CreateGetStringCommand( p_filter, CFG_PREFIX "blend-image" );
     i_ret = blendbench_LoadImage( p_this, &p_sys->p_blend_image, p_sys->i_blend_chroma,
                                   psz_cmd, "Blend" );