diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-09-05 00:36:44 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-10-03 01:04:18 +0200 |
| commit | c17fd9f9ce2eb2e4bd11045faa4d6ae8b1fe8e1c (patch) | |
| tree | cebbe1aabc6c4d6b606b0ef78d01534563848859 | |
| parent | 0f3cdddf3886ebd5abc8efad72bc193189c815bf (diff) | |
| download | ffmpeg-c17fd9f9ce2eb2e4bd11045faa4d6ae8b1fe8e1c.tar.gz | |
avcodec/mjpegdec: Add some sanity checks to ljpeg_decode_rgb_scan()
These prevent the rgb ljpeg code from being run on parameters that it doesnt
support. No testcase available but it seems possible to trigger these.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61c68000eda643dfce96dc46b488d39fd5c4e309)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mjpegdec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index f1e9b6809b..d399efe6f5 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -774,6 +774,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p int resync_mb_y = 0; int resync_mb_x = 0; + if (s->nb_components != 3 && s->nb_components != 4) + return AVERROR_INVALIDDATA; + if (s->v_max != 1 || s->h_max != 1 || !s->lossless) + return AVERROR_INVALIDDATA; + + s->restart_count = s->restart_interval; av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size, |