diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-03 14:38:37 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-07-03 14:38:37 +0200 |
commit | a4a16821d7326a6a62c6ac3d9fc8b3d8f111cefc (patch) | |
tree | 0df0a4ee73ad8a56f5891b89625d1ccf56fa8800 | |
parent | 2cad1ea29e4df69a556a95e942968184493fb249 (diff) | |
parent | fd54dd028bc9f7bfb80ebf823a533dc84b73f936 (diff) | |
download | ffmpeg-a4a16821d7326a6a62c6ac3d9fc8b3d8f111cefc.tar.gz |
Merge commit 'fd54dd028bc9f7bfb80ebf823a533dc84b73f936'
* commit 'fd54dd028bc9f7bfb80ebf823a533dc84b73f936':
jpeg2000: check len before parsing header
jpeg2000: Check component number in get_coc() and get_qcc()
Conflicts:
libavcodec/jpeg2000dec.c
Merged-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r-- | libavcodec/jpeg2000dec.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index ecd14c2904..0856beca94 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -375,7 +375,9 @@ static int get_coc(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c, compno = bytestream2_get_byteu(&s->g); if (compno >= s->ncomponents) { - av_log(s->avctx, AV_LOG_ERROR, "Invalid compno %d\n", compno); + av_log(s->avctx, AV_LOG_ERROR, + "Invalid compno %d. There are %d components in the image.\n", + compno, s->ncomponents); return AVERROR_INVALIDDATA; } @@ -459,9 +461,12 @@ static int get_qcc(Jpeg2000DecoderContext *s, int n, Jpeg2000QuantStyle *q, if (bytestream2_get_bytes_left(&s->g) < 1) return AVERROR_INVALIDDATA; - compno = bytestream2_get_byteu(&s->g); + compno = bytestream2_get_byteu(&s->g); + if (compno >= s->ncomponents) { - av_log(s->avctx, AV_LOG_ERROR, "Invalid compno\n"); + av_log(s->avctx, AV_LOG_ERROR, + "Invalid compno %d. There are %d components in the image.\n", + compno, s->ncomponents); return AVERROR_INVALIDDATA; } @@ -1282,6 +1287,7 @@ static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s) len = bytestream2_get_be16(&s->g); if (len < 2 || bytestream2_get_bytes_left(&s->g) < len - 2) return AVERROR_INVALIDDATA; + switch (marker) { case JPEG2000_SIZ: ret = get_siz(s); |