RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/cbs_jpeg: Try to move the read entity to one side in a test 

The checked entity should be alone on one side of the check, this avoids
complex considerations of overflows.
This fixes a issue of bad style in our code and a coverity issue.

Fixes: CID1439654 Untrusted pointer read

Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2024-05-01 22:33:14 +02:00
parent 4bca147415
commit 385784a148
No known key found for this signature in database
GPG Key ID: B18E8928B3948D64
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/cbs_jpeg.c
View File

@ -146,13 +146,13 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx,
} }
} else { } else {
i = start; i = start;
if (i + 2 > frag->data_size) { if (i > frag->data_size - 2) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: " av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
"truncated at %02x marker.\n", marker); "truncated at %02x marker.\n", marker);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
length = AV_RB16(frag->data + i); length = AV_RB16(frag->data + i);
if (i + length > frag->data_size) { if (length > frag->data_size - i) {
av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: " av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: "
"truncated at %02x marker segment.\n", marker); "truncated at %02x marker segment.\n", marker);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;