From: Michael Niedermayer <michael@niedermayer.cc>
Date: Tue, 24 Jan 2017 23:20:19 +0000 (+0100)
Subject: avcodec/utils: correct align value for interplay
X-Git-Tag: archive/raspbian/6%11.12-1_deb8u8+rpi1^2~16
X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=144a35aa8bcf3908d8255edabd0688b2b8a97a82;p=libav.git

avcodec/utils: correct align value for interplay

Fixes out of array access
Fixes: 452/fuzz-1-ffmpeg_VIDEO_AV_CODEC_ID_INTERPLAY_VIDEO_fuzzer

Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/targets/ffmpeg
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>

Gbp-Pq: Name CVE-2017-7865.patch
---

diff --git a/libavcodec/utils.c b/libavcodec/utils.c
index 5a3e952..3c934a0 100644
--- a/libavcodec/utils.c
+++ b/libavcodec/utils.c
@@ -247,6 +247,10 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
             w_align = 4;
             h_align = 4;
         }
+        if (s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
+            w_align = 8;
+            h_align = 8;
+        }
     case AV_PIX_FMT_PAL8:
     case AV_PIX_FMT_BGR8:
     case AV_PIX_FMT_RGB8:
@@ -254,7 +258,8 @@ void avcodec_align_dimensions2(AVCodecContext *s, int *width, int *height,
             w_align = 4;
             h_align = 4;
         }
-        if (s->codec_id == AV_CODEC_ID_JV) {
+        if (s->codec_id == AV_CODEC_ID_JV ||
+            s->codec_id == AV_CODEC_ID_INTERPLAY_VIDEO) {
             w_align = 8;
             h_align = 8;
         }