generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/mjpegdec: check bits per pixel for changes similar to dimensions

Browse Source 
Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2014-10-03 01:50:27 +02:00
parent 06e7d58410
commit 5c378d6a6d
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
libavcodec/mjpegdec.c
View File

@ -244,7 +244,7 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
int ff_mjpeg_decode_sof(MJpegDecodeContext *s) int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
{ {
int len, nb_components, i, width, height, pix_fmt_id, ret; int len, nb_components, i, width, height, bits, pix_fmt_id, ret;
int h_count[MAX_COMPONENTS]; int h_count[MAX_COMPONENTS];
int v_count[MAX_COMPONENTS]; int v_count[MAX_COMPONENTS];
@ -254,11 +254,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* XXX: verify len field validity */ /* XXX: verify len field validity */
len = get_bits(&s->gb, 16); len = get_bits(&s->gb, 16);
s->avctx->bits_per_raw_sample = s->avctx->bits_per_raw_sample =
s->bits = get_bits(&s->gb, 8); bits = get_bits(&s->gb, 8);
if (s->pegasus_rct) if (s->pegasus_rct)
s->bits = 9; bits = 9;
if (s->bits == 9 && !s->pegasus_rct) if (bits == 9 && !s->pegasus_rct)
s->rct = 1; // FIXME ugly s->rct = 1; // FIXME ugly
if(s->lossless && s->avctx->lowres){ if(s->lossless && s->avctx->lowres){
@ -291,7 +291,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
} }
if (s->ls && !(s->bits <= 8 || nb_components == 1)) { if (s->ls && !(bits <= 8 || nb_components == 1)) {
avpriv_report_missing_feature(s->avctx, avpriv_report_missing_feature(s->avctx,
"JPEG-LS that is not <= 8 " "JPEG-LS that is not <= 8 "
"bits/component or 16-bit gray"); "bits/component or 16-bit gray");
@ -337,11 +337,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* if different size, realloc/alloc picture */ /* if different size, realloc/alloc picture */
if ( width != s->width || height != s->height if ( width != s->width || height != s->height
|| bits != s->bits
|| memcmp(s->h_count, h_count, sizeof(h_count)) || memcmp(s->h_count, h_count, sizeof(h_count))
|| memcmp(s->v_count, v_count, sizeof(v_count))) { || memcmp(s->v_count, v_count, sizeof(v_count))) {
s->width = width; s->width = width;
s->height = height; s->height = height;
s->bits = bits;
memcpy(s->h_count, h_count, sizeof(h_count)); memcpy(s->h_count, h_count, sizeof(h_count));
memcpy(s->v_count, v_count, sizeof(v_count)); memcpy(s->v_count, v_count, sizeof(v_count));
s->interlaced = 0; s->interlaced = 0;