RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mjpegdec: Fix context fields becoming inconsistent 

Fixes out of array access
Fixes: asan_heap-oob_1ca4f85_2760_cov_144449187_miss_congeniality_pegasus_ljpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-11-25 13:53:06 +01:00
parent ca59b5b6ec
commit 0eecf40935
1 changed files with 16 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
libavcodec/mjpegdec.c
View File

@ -1620,6 +1620,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
} }
if (id == AV_RB32("LJIF")) { if (id == AV_RB32("LJIF")) {
int rgb = s->rgb;
int pegasus_rct = s->pegasus_rct;
if (s->avctx->debug & FF_DEBUG_PICT_INFO) if (s->avctx->debug & FF_DEBUG_PICT_INFO)
av_log(s->avctx, AV_LOG_INFO, av_log(s->avctx, AV_LOG_INFO,
"Pegasus lossless jpeg header found\n"); "Pegasus lossless jpeg header found\n");
@ -1629,17 +1631,27 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
skip_bits(&s->gb, 16); /* unknown always 0? */ skip_bits(&s->gb, 16); /* unknown always 0? */
switch (i=get_bits(&s->gb, 8)) { switch (i=get_bits(&s->gb, 8)) {
case 1: case 1:
s->rgb = 1; rgb = 1;
s->pegasus_rct = 0; pegasus_rct = 0;
break; break;
case 2: case 2:
s->rgb = 1; rgb = 1;
s->pegasus_rct = 1; pegasus_rct = 1;
break; break;
default: default:
av_log(s->avctx, AV_LOG_ERROR, "unknown colorspace %d\n", i); av_log(s->avctx, AV_LOG_ERROR, "unknown colorspace %d\n", i);
} }
len -= 9; len -= 9;
if (s->got_picture)
if (rgb != s->rgb || pegasus_rct != s->pegasus_rct) {
av_log(s->avctx, AV_LOG_WARNING, "Mismatching LJIF tag\n");
goto out;
}
s->rgb = rgb;
s->pegasus_rct = pegasus_rct;
goto out; goto out;
} }
if (id == AV_RL32("colr") && len > 0) { if (id == AV_RL32("colr") && len > 0) {