diff options
| author | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2015-07-16 00:36:13 +0200 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2015-07-16 00:36:13 +0200 |
| commit | 9901e5318730ad5f9fb3272aa370e7affe168ddb (patch) | |
| tree | 6e15aae002113c7574ebb513de6e87000ca060f1 | |
| parent | 99b0cadd1388181296e01091acfef20e0dbd33c6 (diff) | |
| download | ffmpeg-9901e5318730ad5f9fb3272aa370e7affe168ddb.tar.gz | |
lavf/rtpenc_jpeg: Fix sending multiple quantization tables.
| -rw-r--r-- | libavformat/rtpenc_jpeg.c | 17 |
1 files changed, 12 insertions, 5 deletions
diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c index 13d61a97aa..e6b3177fe8 100644 --- a/libavformat/rtpenc_jpeg.c +++ b/libavformat/rtpenc_jpeg.c @@ -28,7 +28,7 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) { RTPMuxContext *s = s1->priv_data; - const uint8_t *qtables = NULL; + const uint8_t *qtables[4] = { NULL }; int nb_qtables = 0; uint8_t type; uint8_t w, h; @@ -64,18 +64,25 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) continue; if (buf[i + 1] == DQT) { + int tables, j; if (buf[i + 4] & 0xF0) av_log(s1, AV_LOG_WARNING, "Only 8-bit precision is supported.\n"); /* a quantization table is 64 bytes long */ - nb_qtables = AV_RB16(&buf[i + 2]) / 65; - if (i + 4 + nb_qtables * 65 > size) { + tables = AV_RB16(&buf[i + 2]) / 65; + if (i + 5 + tables * 65 > size) { av_log(s1, AV_LOG_ERROR, "Too short JPEG header. Aborted!\n"); return; } + if (nb_qtables + tables > 4) { + av_log(s1, AV_LOG_ERROR, "Invalid number of quantisation tables\n"); + return; + } - qtables = &buf[i + 4]; + for (j = 0; j < tables; j++) + qtables[nb_qtables + j] = buf + i + 5 + j * 65; + nb_qtables += tables; } else if (buf[i + 1] == SOF0) { if (buf[i + 14] != 17 || buf[i + 17] != 17) { av_log(s1, AV_LOG_ERROR, @@ -150,7 +157,7 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) bytestream_put_be16(&p, 64 * nb_qtables); for (i = 0; i < nb_qtables; i++) - bytestream_put_buffer(&p, &qtables[65 * i + 1], 64); + bytestream_put_buffer(&p, qtables[i], 64); } /* copy payload data */ |