generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/mjpegdec: Skip blocks which are outside the visible area

Browse Source 
Fixes out of array accesses
Fixes: ffmpeg_mjpeg_crash.avi

Found-by: Thomas Lindroth <thomas.lindroth@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 08509c8f86)

Conflicts:

	libavcodec/mjpegdec.c
This commit is contained in:
Michael Niedermayer
2015-02-11 03:33:53 +01:00
parent 9d49f4e081
commit 9db3ed2583
1 changed files with 13 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/mjpegdec.c
View File

@@ -1079,12 +1079,17 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,
if (s->interlaced && s->bottom_field) if (s->interlaced && s->bottom_field)
block_offset += linesize[c] >> 1; block_offset += linesize[c] >> 1;
if ( 8*(h * mb_x + x) < s->width
&& 8*(v * mb_y + y) < s->height) {
ptr = data[c] + block_offset; ptr = data[c] + block_offset;
} else
ptr = NULL;
if (!s->progressive) { if (!s->progressive) {
if (copy_mb) if (copy_mb) {
if (ptr)
mjpeg_copy_block(ptr, reference_data[c] + block_offset, mjpeg_copy_block(ptr, reference_data[c] + block_offset,
linesize[c], s->avctx->lowres); linesize[c], s->avctx->lowres);
else { } else {
s->dsp.clear_block(s->block); s->dsp.clear_block(s->block);
if (decode_block(s, s->block, i, if (decode_block(s, s->block, i,
s->dc_index[i], s->ac_index[i], s->dc_index[i], s->ac_index[i],
@@ -1093,8 +1098,10 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah,
"error y=%d x=%d\n", mb_y, mb_x); "error y=%d x=%d\n", mb_y, mb_x);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
if (ptr) {
s->dsp.idct_put(ptr, linesize[c], s->block); s->dsp.idct_put(ptr, linesize[c], s->block);
} }
}
} else { } else {
int block_idx = s->block_stride[c] * (v * mb_y + y) + int block_idx = s->block_stride[c] * (v * mb_y + y) +
(h * mb_x + x); (h * mb_x + x);