aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2014-10-03 01:50:27 +0200
committerMichael Niedermayer <michaelni@gmx.at>2014-11-28 20:27:41 +0100
commitf7170c48328d5d1b22a2d5e7e8888fab37da37b5 (patch)
treee4a4a91b99bf07df3bd226081425d1e307f18043
parent37140360112135990e21a41ec12c41fdf5987f92 (diff)
downloadffmpeg-f7170c48328d5d1b22a2d5e7e8888fab37da37b5.tar.gz
avcodec/mjpegdec: check bits per pixel for changes similar to dimensions
Fixes out of array accesses Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit 5c378d6a6df8243f06c87962b873bd563e58cd39) Conflicts: libavcodec/mjpegdec.c (cherry picked from commit 94371a404c663c3dae3d542fa43951567ab67f82) Conflicts: libavcodec/mjpegdec.c Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/mjpegdec.c17
1 files changed, 10 insertions, 7 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index e5c9f38b93..cbaebb2f30 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -193,16 +193,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
{
- int len, nb_components, i, width, height, pix_fmt_id;
+ int len, nb_components, i, width, height, bits, pix_fmt_id;
/* XXX: verify len field validity */
len = get_bits(&s->gb, 16);
- s->bits= get_bits(&s->gb, 8);
+ bits= get_bits(&s->gb, 8);
- if(s->pegasus_rct) s->bits=9;
- if(s->bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly
+ if(s->pegasus_rct) bits=9;
+ if(bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly
- if (s->bits != 8 && !s->lossless){
+ if (bits != 8 && !s->lossless){
av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n");
return -1;
}
@@ -222,7 +222,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
if (nb_components <= 0 ||
nb_components > MAX_COMPONENTS)
return -1;
- if (s->ls && !(s->bits <= 8 || nb_components == 1)){
+ if (s->ls && !(bits <= 8 || nb_components == 1)){
av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n");
return -1;
}
@@ -255,11 +255,14 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* if different size, realloc/alloc picture */
/* XXX: also check h_count and v_count */
- if (width != s->width || height != s->height) {
+ if ( width != s->width || height != s->height
+ || bits != s->bits
+ ) {
av_freep(&s->qscale_table);
s->width = width;
s->height = height;
+ s->bits = bits;
s->interlaced = 0;
/* test interlaced mode */