projects
/
platform
/
upstream
/
libav.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
c209d0d
)
mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac
author
Luca Barbato
<lu_zero@gentoo.org>
Wed, 15 May 2013 16:41:41 +0000
(18:41 +0200)
committer
Luca Barbato
<lu_zero@gentoo.org>
Tue, 21 May 2013 07:46:02 +0000
(09:46 +0200)
Prevent out of buffer write when decoding broken samples.
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
libavcodec/mjpegdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/mjpegdec.c
b/libavcodec/mjpegdec.c
index
896fa99
..
934d1a2
100644
(file)
--- a/
libavcodec/mjpegdec.c
+++ b/
libavcodec/mjpegdec.c
@@
-941,6
+941,11
@@
static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
GetBitContext mb_bitmask_gb;
+ if (ss < 0 || ss >= 64 ||
+ se < ss || se >= 64 ||
+ Ah < 0 || Al < 0)
+ return AVERROR_INVALIDDATA;
+
if (mb_bitmask)
init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);