nuv: check RTjpeg header for validity
CC: libav-stable@libav.org
(cherry picked from commit 859a579e9b)
Signed-off-by: Anton Khirnov <anton@khirnov.net>
			
			
This commit is contained in:
		
				
					committed by
					
						
						Anton Khirnov
					
				
			
			
				
	
			
			
			
						parent
						
							fdb7080781
						
					
				
				
					commit
					6704522ca9
				
			@@ -184,17 +184,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
 | 
			
		||||
    }
 | 
			
		||||
    if (c->codec_frameheader) {
 | 
			
		||||
        int w, h, q;
 | 
			
		||||
        if (buf_size < 12) {
 | 
			
		||||
        if (buf_size < RTJPEG_HEADER_SIZE || buf[4] != RTJPEG_HEADER_SIZE ||
 | 
			
		||||
            buf[5] != RTJPEG_FILE_VERSION) {
 | 
			
		||||
            av_log(avctx, AV_LOG_ERROR, "invalid nuv video frame\n");
 | 
			
		||||
            return -1;
 | 
			
		||||
            return AVERROR_INVALIDDATA;
 | 
			
		||||
        }
 | 
			
		||||
        w = AV_RL16(&buf[6]);
 | 
			
		||||
        h = AV_RL16(&buf[8]);
 | 
			
		||||
        q = buf[10];
 | 
			
		||||
        if (!codec_reinit(avctx, w, h, q))
 | 
			
		||||
            return -1;
 | 
			
		||||
        buf = &buf[12];
 | 
			
		||||
        buf_size -= 12;
 | 
			
		||||
        buf = &buf[RTJPEG_HEADER_SIZE];
 | 
			
		||||
        buf_size -= RTJPEG_HEADER_SIZE;
 | 
			
		||||
    }
 | 
			
		||||
 | 
			
		||||
    if (keyframe && c->pic.data[0])
 | 
			
		||||
 
 | 
			
		||||
@@ -25,6 +25,9 @@
 | 
			
		||||
#include <stdint.h>
 | 
			
		||||
#include "dsputil.h"
 | 
			
		||||
 | 
			
		||||
#define RTJPEG_FILE_VERSION 0
 | 
			
		||||
#define RTJPEG_HEADER_SIZE 12
 | 
			
		||||
 | 
			
		||||
typedef struct {
 | 
			
		||||
    int w, h;
 | 
			
		||||
    DSPContext *dsp;
 | 
			
		||||
 
 | 
			
		||||
		Reference in New Issue
	
	Block a user