diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-06-15 03:00:53 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-06-15 03:00:53 +0200 |
| commit | 5b0f55aab9d5802556e7b3a09c50b77a3220b658 (patch) | |
| tree | cdc847d0f1a3980c30b78fb073ff1eebddd2511c /libavcodec/jpeg2000dec.c | |
| parent | a58f1bcc4cbe41747ed88f6abc0b01932ba238a9 (diff) | |
| download | ffmpeg-5b0f55aab9d5802556e7b3a09c50b77a3220b658.tar.gz | |
avcodec/jpeg2000dec: Check reslevelno in RPCL
Fixes out of array read
Fixes Ticket4627
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/jpeg2000dec.c')
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index d5abc42399..d00ef107d1 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -1102,6 +1102,9 @@ static int jpeg2000_decode_packets(Jpeg2000DecoderContext *s, Jpeg2000Tile *tile int xc = x / s->cdx[compno]; int yc = y / s->cdy[compno]; + if (reslevelno >= codsty->nreslevels) + continue; + if (yc % (1 << (rlevel->log2_prec_height + reducedresno))) continue; |