diff options
| author | Janne Grunau <[email protected]> | 2012-08-06 13:59:04 +0200 |
|---|---|---|
| committer | Anton Khirnov <[email protected]> | 2012-10-06 10:34:04 +0200 |
| commit | f695be22d89aab1e0549e6ef04b1431c7db96316 (patch) | |
| tree | 24d9450176826461a3f5839c77b77fd956cc8e1b | |
| parent | 9125aa9218c3ff2ae89ef2094c9138438dbeec70 (diff) | |
nuv: check RTjpeg header for validity
CC: [email protected]
(cherry picked from commit 859a579e9bbf47fae2e09494c43bcf813dcb2fad)
Signed-off-by: Anton Khirnov <[email protected]>
(cherry picked from commit 6704522ca9dd32c858ee474492be568c386910f9)
Signed-off-by: Anton Khirnov <[email protected]>
(cherry picked from commit f31170d4e7f9671e019315391160d454b18d7296)
Signed-off-by: Anton Khirnov <[email protected]>
(cherry picked from commit 459feb7cce03af7154c098171fc9d36fc9d472f6)
Signed-off-by: Anton Khirnov <[email protected]>
| -rw-r--r-- | libavcodec/nuv.c | 9 | ||||
| -rw-r--r-- | libavcodec/rtjpeg.h | 3 |
2 files changed, 8 insertions, 4 deletions
diff --git a/libavcodec/nuv.c b/libavcodec/nuv.c index 109ef41a8c..64ba3ccc10 100644 --- a/libavcodec/nuv.c +++ b/libavcodec/nuv.c @@ -182,17 +182,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size, } if (c->codec_frameheader) { int w, h, q; - if (buf_size < 12) { + if (buf_size < RTJPEG_HEADER_SIZE || buf[4] != RTJPEG_HEADER_SIZE || + buf[5] != RTJPEG_FILE_VERSION) { av_log(avctx, AV_LOG_ERROR, "invalid nuv video frame\n"); - return -1; + return AVERROR_INVALIDDATA; } w = AV_RL16(&buf[6]); h = AV_RL16(&buf[8]); q = buf[10]; if (!codec_reinit(avctx, w, h, q)) return -1; - buf = &buf[12]; - buf_size -= 12; + buf = &buf[RTJPEG_HEADER_SIZE]; + buf_size -= RTJPEG_HEADER_SIZE; } if (keyframe && c->pic.data[0]) diff --git a/libavcodec/rtjpeg.h b/libavcodec/rtjpeg.h index 02f2058b2c..c12a78c67b 100644 --- a/libavcodec/rtjpeg.h +++ b/libavcodec/rtjpeg.h @@ -25,6 +25,9 @@ #include <stdint.h> #include "dsputil.h" +#define RTJPEG_FILE_VERSION 0 +#define RTJPEG_HEADER_SIZE 12 + typedef struct { int w, h; DSPContext *dsp; |