RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-02-28 09:41:01 +00:00
Code Issues Projects Releases Wiki Activity

avcodec/jpeglsdec: Check run value more completely in ls_decode_line()

Browse Source 
previously it could have been by 1 too large
Fixes out of array access
Fixes: asan_heap-oob_12240f5_1_asan_heap-oob_12240f5_448_t8c1e3.jls
Fixes: asan_heap-oob_12240f5_1_asan_heap-oob_12240f5_448_t8nde0.jls
Fixes: asan_heap-oob_12240fa_1_asan_heap-oob_12240fa_448_t16e3.jls

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-10-02 23:17:21 +02:00
parent 77b3e110d2
commit 06e7d58410
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/jpeglsdec.c
View File

@ -269,6 +269,11 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s,
x += stride; x += stride;
} }
if (x >= w) {
av_log(NULL, AV_LOG_ERROR, "run overflow\n");
return;
}
/* decode run termination value */ /* decode run termination value */
Rb = R(last, x); Rb = R(last, x);
RItype = (FFABS(Ra - Rb) <= state->near) ? 1 : 0; RItype = (FFABS(Ra - Rb) <= state->near) ? 1 : 0;