projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
cc5d4f4
)
Fix heap overflow due to lack of nb_components check.
author
Michael Niedermayer
<michaelni@gmx.at>
Mon, 25 Jan 2010 13:26:10 +0000
(13:26 +0000)
committer
Michael Niedermayer
<michaelni@gmx.at>
Mon, 25 Jan 2010 13:26:10 +0000
(13:26 +0000)
Originally committed as revision 21450 to svn://svn.ffmpeg.org/ffmpeg/trunk
libavcodec/mjpegdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/mjpegdec.c
b/libavcodec/mjpegdec.c
index
86862db
..
dc8df55
100644
(file)
--- a/
libavcodec/mjpegdec.c
+++ b/
libavcodec/mjpegdec.c
@@
-899,6
+899,10
@@
int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
/* XXX: verify len field validity */
len = get_bits(&s->gb, 16);
nb_components = get_bits(&s->gb, 8);
+ if (nb_components == 0 || nb_components > MAX_COMPONENTS){
+ av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\n", nb_components);
+ return -1;
+ }
if (len != 6+2*nb_components)
{
av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);