generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Browse Source 
Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit cfbd98abe8)

Signed-off-by: Reinhard Tartler <siretart@tauware.de>
This commit is contained in:
Luca Barbato
2013-05-15 18:41:41 +02:00
committed by Reinhard Tartler
parent 7923a25fdd
commit aed12df7fe
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/mjpegdec.c
View File

@@ -945,6 +945,11 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]]; int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
GetBitContext mb_bitmask_gb; GetBitContext mb_bitmask_gb;
if (ss < 0 || ss >= 64 ||
se < ss || se >= 64 ||
Ah < 0 || Al < 0)
return AVERROR_INVALIDDATA;
if (mb_bitmask) if (mb_bitmask)
init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height); init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);