RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

mjpegbdec: Fix incorrect bitstream buffer size. 

Fixes CVE-2011-3947

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-01-25 23:55:21 +01:00
parent dd453f197c
commit 01e5e97026
1 changed files with 1 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
libavcodec/mjpegbdec.c
View File

@ -111,8 +111,7 @@ read_header:
av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
if (sos_offs) if (sos_offs)
{ {
// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8); init_get_bits(&s->gb, buf_ptr+sos_offs, FFMIN(field_size, buf_end - (buf_ptr+sos_offs))*8);
init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8);
s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
s->start_code = SOS; s->start_code = SOS;
if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&