RepoMirrors
/
ffmpeg
mirror of https://git.ffmpeg.org/ffmpeg.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

avcodec/mjpegdec: verify SOF len field validity 

Reviewed-by: Paul B Mahol <onemda@gmail.com>
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
This commit is contained in:
Michael Niedermayer 2018-12-18 14:25:53 +01:00
parent 645c5e8c91
commit dfb5046cf3
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libavcodec/mjpegdec.c
View File

@ -313,7 +313,6 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
memset(s->upscale_h, 0, sizeof(s->upscale_h));
memset(s->upscale_v, 0, sizeof(s->upscale_v));
/* XXX: verify len field validity */
len = get_bits(&s->gb, 16);
bits = get_bits(&s->gb, 8);
@ -367,6 +366,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
"bits/component or 16-bit gray");
return AVERROR_PATCHWELCOME;
}
if (len != 8 + 3 * nb_components) {
av_log(s->avctx, AV_LOG_ERROR, "decode_sof0: error, len(%d) mismatch %d components\n", len, nb_components);
return AVERROR_INVALIDDATA;
}
s->nb_components = nb_components;
s->h_max = 1;
s->v_max = 1;
@ -712,8 +716,6 @@ unk_pixfmt:
s->width, s->height, s->linesize[0], s->linesize[1],
s->interlaced, s->avctx->height);
if (len != (8 + (3 * nb_components)))
av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
}
if ((s->rgb && !s->lossless && !s->ls) ||