From 021dccba1ff01b9005199fe8671a1887a262b430 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Mon, 25 Jan 2010 13:26:10 +0000
Subject: [PATCH] Fix heap overflow due to lack of nb_components check.

Originally committed as revision 21450 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavcodec/mjpegdec.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 86862dbd40..dc8df55d47 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -899,6 +899,10 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
     /* XXX: verify len field validity */
     len = get_bits(&s->gb, 16);
     nb_components = get_bits(&s->gb, 8);
+    if (nb_components == 0 || nb_components > MAX_COMPONENTS){
+        av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\n", nb_components);
+        return -1;
+    }
     if (len != 6+2*nb_components)
     {
         av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);