diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-15 15:23:38 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-01-03 18:20:43 +0100 |
| commit | d1f74d838ef95b660cf07ad2c8b3ea0af9e523b7 (patch) | |
| tree | 68385ddcd5a1e65cc84dec753d78a8e4bb43ee6f | |
| parent | 07892e33ef393ca7699eb4442583107d9e292041 (diff) | |
| download | ffmpeg-d1f74d838ef95b660cf07ad2c8b3ea0af9e523b7.tar.gz | |
jpegdec: check return value of mjpeg_decode_dc()
Fixes Ticket754
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 484b1cdd5303771447e15d0067a2034b0c17fdc8)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/mjpegdec.c | 23 |
1 files changed, 17 insertions, 6 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index b3b02daab6..b8d73ed481 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -673,15 +673,19 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int predictor, int point s->restart_count = s->restart_interval; for(i=0;i<3;i++) { - int pred; + int pred, dc; topleft[i]= top[i]; top[i]= buffer[mb_x][i]; PREDICT(pred, topleft[i], top[i], left[i], modified_predictor); + dc = mjpeg_decode_dc(s, s->dc_index[i]); + if(dc == 0xFFFF) + return -1; + left[i]= - buffer[mb_x][i]= mask & (pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform)); + buffer[mb_x][i]= mask & (pred + (dc << point_transform)); } if (s->restart_interval && !--s->restart_count) { @@ -735,7 +739,7 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point linesize= s->linesize[c]; for(j=0; j<n; j++) { - int pred; + int pred, dc; ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap if(y==0 && mb_y==0){ @@ -754,7 +758,10 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point if (s->interlaced && s->bottom_field) ptr += linesize >> 1; - *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform); + dc = mjpeg_decode_dc(s, s->dc_index[i]); + if(dc == 0xFFFF) + return -1; + *ptr= pred + (dc << point_transform); if (++x == h) { x = 0; @@ -765,7 +772,7 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point }else{ for(i=0;i<nb_components;i++) { uint8_t *ptr; - int n, h, v, x, y, c, j, linesize; + int n, h, v, x, y, c, j, linesize, dc; n = s->nb_blocks[i]; c = s->comp_index[i]; h = s->h_scount[i]; @@ -779,7 +786,11 @@ static int ljpeg_decode_yuv_scan(MJpegDecodeContext *s, int predictor, int point ptr = s->picture.data[c] + (linesize * (v * mb_y + y)) + (h * mb_x + x); //FIXME optimize this crap PREDICT(pred, ptr[-linesize-1], ptr[-linesize], ptr[-1], predictor); - *ptr= pred + (mjpeg_decode_dc(s, s->dc_index[i]) << point_transform); + + dc = mjpeg_decode_dc(s, s->dc_index[i]); + if(dc == 0xFFFF) + return -1; + *ptr= pred + (dc << point_transform); if (++x == h) { x = 0; y++; |