generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge commit '10f77c165c3b3e881bb174a0f57dd62083639072' into release/1.1

Browse Source 
* commit '10f77c165c3b3e881bb174a0f57dd62083639072':
  pixdesc: mark gray8 as pseudopal
  mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
  mjpeg: Validate sampling factors
  ljpeg: use the correct number of components in yuv
  wavpack: validate samples size parsed in wavpack_decode_block

Conflicts:
	libavcodec/mjpegdec.c

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2013-06-03 00:40:23 +02:00
parent cff8d01e15 10f77c165c
commit 683cbbb721
2 changed files with 18 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
libavcodec/mjpegdec.c
View File

@@ -279,15 +279,18 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
s->h_max = h_count[i];
if (v_count[i] > s->v_max)
s->v_max = v_count[i];
if (!h_count[i] || !v_count[i]) {
av_log(s->avctx, AV_LOG_ERROR, "h/v_count is 0\n");
return -1;
}
s->quant_index[i] = get_bits(&s->gb, 8);
if (s->quant_index[i] >= 4) {
av_log(s->avctx, AV_LOG_ERROR, "quant_index is invalid\n");
return AVERROR_INVALIDDATA;
}
if (!h_count[i] || !v_count[i]) {
av_log(s->avctx, AV_LOG_ERROR,
"Invalid sampling factor in component %d %d:%d\n",
i, h_count[i], v_count[i]);
return AVERROR_INVALIDDATA;
}
av_log(s->avctx, AV_LOG_DEBUG, "component %d %d:%d id: %d quant:%d\n",
i, h_count[i], v_count[i],
s->component_id[i], s->quant_index[i]);
@@ -845,17 +848,16 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
}
static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor,
int point_transform)
int point_transform, int nb_components)
{
int i, mb_x, mb_y;
const int nb_components=s->nb_components;
int bits= (s->bits+7)&~7;
int resync_mb_y = 0;
int resync_mb_x = 0;
point_transform += bits - s->bits;
av_assert0(nb_components==1 || nb_components==3);
av_assert0(nb_components>=1 && nb_components<=3);
for (mb_y = 0; mb_y < s->mb_height; mb_y++) {
for (mb_x = 0; mb_x < s->mb_width; mb_x++) {
@@ -1124,8 +1126,9 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
int last_scan = 0;
int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
if (se > 63) {
av_log(s->avctx, AV_LOG_ERROR, "SE %d is too large\n", se);
av_assert0(ss>=0 && Ah>=0 && Al>=0);
if (se < ss || se > 63) {
av_log(s->avctx, AV_LOG_ERROR, "SS/SE %d/%d is invalid\n", ss, se);
return AVERROR_INVALIDDATA;
}
@@ -1287,7 +1290,9 @@ next_field:
if ((ret = ljpeg_decode_rgb_scan(s, nb_components, predictor, point_transform)) < 0)
return ret;
} else {
if ((ret = ljpeg_decode_yuv_scan(s, predictor, point_transform)) < 0)
if ((ret = ljpeg_decode_yuv_scan(s, predictor,
point_transform,
nb_components)) < 0)
return ret;
}
}

7
libavcodec/wavpack.c
View File

@@ -803,14 +803,13 @@ static int wavpack_decode_block(AVCodecContext *avctx, int block_no,
if (!wc->mkv_mode) {
s->samples = AV_RL32(buf); buf += 4;
if (s->samples != wc->samples)
return AVERROR_INVALIDDATA;
if (!s->samples) {
*got_frame_ptr = 0;
return 0;
}
if (s->samples > wc->samples) {
av_log(avctx, AV_LOG_ERROR, "too many samples in block");
return -1;
}
} else {
s->samples = wc->samples;
}