Vulnerability: The rpza_decode_stream function in libavcodec/rpza.c in FFmpeg before 2.1 does not properly maintain a pointer to pixel data, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted Apple RPZA data.
Vulnerability ID: CVE-2013-7009
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/FFmpeg/FFmpeg
Published: 2013-12-09
File: libavcodec/rpza.c
Commit message: avcodec/rpza: Perform pointer advance and checks before using the pointers

Fixes out of array accesses
Fixes Ticket2850

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Commit author: Michael Niedermayer

Vulnerable version (before fix):
 static void rpza_decode_stream(RpzaContext *s)     unsigned short *pixels = (unsigned short *)s->frame.data[0];      int row_ptr = 0;     int pixel_ptr = 0;     int block_ptr;     int pixel_x, pixel_y;     int total_blocks; static void rpza_decode_stream(RpzaContext *s)             colorA = AV_RB16 (&s->buf[stream_ptr]);             stream_ptr += 2;             while (n_blocks--) {                 block_ptr = row_ptr + pixel_ptr;                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {                     for (pixel_x = 0; pixel_x < 4; pixel_x++){ static void rpza_decode_stream(RpzaContext *s)                     }                     block_ptr += row_inc;                 }                 ADVANCE_BLOCK();             }             break;  static void rpza_decode_stream(RpzaContext *s)             if (s->size - stream_ptr < n_blocks * 4)                 return;             while (n_blocks--) {                 block_ptr = row_ptr + pixel_ptr;                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {                     index = s->buf[stream_ptr++]; static void rpza_decode_stream(RpzaContext *s)                     }                     block_ptr += row_inc;                 }                 ADVANCE_BLOCK();             }             break;          /* Fill block with 16 colors */         case 0x00:             if (s->size - stream_ptr < 16)                 return;             block_ptr = row_ptr + pixel_ptr;             for (pixel_y = 0; pixel_y < 4; pixel_y++) {                 for (pixel_x = 0; pixel_x < 4; pixel_x++){ static void rpza_decode_stream(RpzaContext *s)                 }                 block_ptr += row_inc;             }             ADVANCE_BLOCK();             break;          /* Unknown opcode */

Fixed version (after fix):
 static void rpza_decode_stream(RpzaContext *s)     unsigned short *pixels = (unsigned short *)s->frame.data[0];      int row_ptr = 0;     int pixel_ptr = -4;     int block_ptr;     int pixel_x, pixel_y;     int total_blocks; static void rpza_decode_stream(RpzaContext *s)             colorA = AV_RB16 (&s->buf[stream_ptr]);             stream_ptr += 2;             while (n_blocks--) {                 ADVANCE_BLOCK()                 block_ptr = row_ptr + pixel_ptr;                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {                     for (pixel_x = 0; pixel_x < 4; pixel_x++){ static void rpza_decode_stream(RpzaContext *s)                     }                     block_ptr += row_inc;                 }             }             break;  static void rpza_decode_stream(RpzaContext *s)             if (s->size - stream_ptr < n_blocks * 4)                 return;             while (n_blocks--) {                 ADVANCE_BLOCK();                 block_ptr = row_ptr + pixel_ptr;                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {                     index = s->buf[stream_ptr++]; static void rpza_decode_stream(RpzaContext *s)                     }                     block_ptr += row_inc;                 }             }             break;          /* Fill block with 16 colors */         case 0x00:             if (s->size - stream_ptr < 16)                 return;             ADVANCE_BLOCK();             block_ptr = row_ptr + pixel_ptr;             for (pixel_y = 0; pixel_y < 4; pixel_y++) {                 for (pixel_x = 0; pixel_x < 4; pixel_x++){ static void rpza_decode_stream(RpzaContext *s)                 }                 block_ptr += row_inc;             }             break;          /* Unknown opcode */

Patch:
patch: @@ -85,7 +85,7 @@ static void rpza_decode_stream(RpzaContext *s)
     unsigned short *pixels = (unsigned short *)s->frame.data[0];
 
     int row_ptr = 0;
-    int pixel_ptr = 0;
+    int pixel_ptr = -4;
     int block_ptr;
     int pixel_x, pixel_y;
     int total_blocks;
@@ -141,6 +141,7 @@ static void rpza_decode_stream(RpzaContext *s)
             colorA = AV_RB16 (&s->buf[stream_ptr]);
             stream_ptr += 2;
             while (n_blocks--) {
+                ADVANCE_BLOCK()
                 block_ptr = row_ptr + pixel_ptr;
                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                     for (pixel_x = 0; pixel_x < 4; pixel_x++){
@@ -149,7 +150,6 @@ static void rpza_decode_stream(RpzaContext *s)
                     }
                     block_ptr += row_inc;
                 }
-                ADVANCE_BLOCK();
             }
             break;
 
@@ -188,6 +188,7 @@ static void rpza_decode_stream(RpzaContext *s)
             if (s->size - stream_ptr < n_blocks * 4)
                 return;
             while (n_blocks--) {
+                ADVANCE_BLOCK();
                 block_ptr = row_ptr + pixel_ptr;
                 for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                     index = s->buf[stream_ptr++];
@@ -198,14 +199,14 @@ static void rpza_decode_stream(RpzaContext *s)
                     }
                     block_ptr += row_inc;
                 }
-                ADVANCE_BLOCK();
             }
             break;
 
         /* Fill block with 16 colors */
         case 0x00:
             if (s->size - stream_ptr < 16)
                 return;
+            ADVANCE_BLOCK();
             block_ptr = row_ptr + pixel_ptr;
             for (pixel_y = 0; pixel_y < 4; pixel_y++) {
                 for (pixel_x = 0; pixel_x < 4; pixel_x++){
@@ -219,7 +220,6 @@ static void rpza_decode_stream(RpzaContext *s)
                 }
                 block_ptr += row_inc;
             }
-            ADVANCE_BLOCK();
             break;
 
         /* Unknown opcode */
path: libavcodec/rpza.c