diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-06-14 00:35:52 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-14 00:36:45 +0200 |
| commit | 129edcb50facad324d80a1e28b6d4be05ce70ab7 (patch) | |
| tree | 4029666b83ac5320c7a5ab848ee04a3d21d2f87c | |
| parent | ff0bdf937568908a35d4091cb5c83a0155117ae6 (diff) | |
| download | ffmpeg-129edcb50facad324d80a1e28b6d4be05ce70ab7.tar.gz | |
jpeg2000dec: dont set ncomponents to an invalid value
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index da510c66ac..87a1d58e77 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -160,6 +160,7 @@ static int tag_tree_decode(Jpeg2000DecoderContext *s, Jpeg2000TgtNode *node, static int get_siz(Jpeg2000DecoderContext *s) { int i; + int ncomponents; if (bytestream2_get_bytes_left(&s->g) < 36) return AVERROR(EINVAL); @@ -173,12 +174,14 @@ static int get_siz(Jpeg2000DecoderContext *s) s->tile_height = bytestream2_get_be32u(&s->g); // YTSiz s->tile_offset_x = bytestream2_get_be32u(&s->g); // XT0Siz s->tile_offset_y = bytestream2_get_be32u(&s->g); // YT0Siz - s->ncomponents = bytestream2_get_be16u(&s->g); // CSiz + ncomponents = bytestream2_get_be16u(&s->g); // CSiz - if (s->ncomponents <= 0 || s->ncomponents > 4) { - av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", s->ncomponents); + if (ncomponents <= 0 || ncomponents > 4) { + av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", ncomponents); return AVERROR(EINVAL); } + s->ncomponents = ncomponents; + if (s->tile_width<=0 || s->tile_height<=0) return AVERROR(EINVAL); |