RepoMirrors/ffmpeg
1
0
Fork 0
mirror of https://git.ffmpeg.org/ffmpeg.git synced 2025-04-28 22:28:14 +00:00
Code Issues Projects Releases Wiki Activity

mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Browse Source 
Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
This commit is contained in:
Luca Barbato 2013-05-15 18:41:41 +02:00
parent c209d0df65
commit cfbd98abe8
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/mjpegdec.c
View File

@ -941,6 +941,11 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]]; int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
GetBitContext mb_bitmask_gb; GetBitContext mb_bitmask_gb;
if (ss < 0 || ss >= 64 ||
se < ss || se >= 64 ||
Ah < 0 || Al < 0)
return AVERROR_INVALIDDATA;
if (mb_bitmask) if (mb_bitmask)
init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height); init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);