diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2009-05-30 10:04:09 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2009-05-30 10:04:09 +0000 |
| commit | ff8c65f482d9daea458ab2f419db4b841d718c5c (patch) | |
| tree | 2ad6103224c5087b1b966c77856a366b14abcbd8 | |
| parent | c40f366372ed27e2a6ca51e413615c661608e82e (diff) | |
| download | ffmpeg-ff8c65f482d9daea458ab2f419db4b841d718c5c.tar.gz | |
Make sure offsets of mjpeg b are within the buffer.
Fixes issue1132
Originally committed as revision 18996 to svn://svn.ffmpeg.org/ffmpeg/trunk
| -rw-r--r-- | libavcodec/mjpegbdec.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c index 04ad6c106c..185e7bb55c 100644 --- a/libavcodec/mjpegbdec.c +++ b/libavcodec/mjpegbdec.c @@ -28,6 +28,14 @@ #include "mjpeg.h" #include "mjpegdec.h" +static uint32_t read_offs(AVCodecContext *avctx, GetBitContext *gb, uint32_t size, const char *err_msg){ + uint32_t offs= get_bits_long(gb, 32); + if(offs >= size){ + av_log(avctx, AV_LOG_WARNING, err_msg, offs, size); + return 0; + } + return offs; +} static int mjpegb_decode_frame(AVCodecContext *avctx, void *data, int *data_size, @@ -64,10 +72,10 @@ read_header: field_size = get_bits_long(&hgb, 32); /* field size */ av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\n", field_size); skip_bits(&hgb, 32); /* padded field size */ - second_field_offs = get_bits_long(&hgb, 32); + second_field_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "second_field_offs is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\n", second_field_offs); - dqt_offs = get_bits_long(&hgb, 32); + dqt_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dqt is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\n", dqt_offs); if (dqt_offs) { @@ -76,7 +84,7 @@ read_header: ff_mjpeg_decode_dqt(s); } - dht_offs = get_bits_long(&hgb, 32); + dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\n", dht_offs); if (dht_offs) { @@ -85,7 +93,7 @@ read_header: ff_mjpeg_decode_dht(s); } - sof_offs = get_bits_long(&hgb, 32); + sof_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\n", sof_offs); if (sof_offs) { @@ -95,9 +103,9 @@ read_header: return -1; } - sos_offs = get_bits_long(&hgb, 32); + sos_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sos is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\n", sos_offs); - sod_offs = get_bits_long(&hgb, 32); + sod_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n"); av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); if (sos_offs) { |