diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index c594950500..559bda5e6f 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -373,7 +373,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) s->v_max = 1; for (i = 0; i < nb_components; i++) { /* component id */ - s->component_id[i] = get_bits(&s->gb, 8) - 1; + int id = get_bits(&s->gb, 8); + if (id == 0) + return AVERROR_INVALIDDATA; + s->component_id[i] = id - 1; h_count[i] = get_bits(&s->gb, 4); v_count[i] = get_bits(&s->gb, 4); /* compute hmax and vmax (only used in interleaved case) */ @@ -1677,7 +1680,10 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask, return AVERROR_INVALIDDATA; } for (i = 0; i < nb_components; i++) { - id = get_bits(&s->gb, 8) - 1; + id = get_bits(&s->gb, 8); + if (id == 0) + return AVERROR_INVALIDDATA; + id -= 1; av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id); /* find component index */ for (index = 0; index < s->nb_components; index++)