diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-07-01 10:01:05 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-02 20:05:44 +0200 |
| commit | 7e201d575dc4385eb67314b0419d4d77185e65f4 (patch) | |
| tree | f776f0efaf0cb9ad572aaf72d4a39ed96370c5ee /libavcodec/jpeg2000dec.c | |
| parent | 278a923c51187d37445d88a6b21082036ec9568d (diff) | |
| download | ffmpeg-7e201d575dc4385eb67314b0419d4d77185e65f4.tar.gz | |
jpeg2000: Validate block lengthinc
Currently we are using an array with a static data size.
Similar to a patch with the same purpose by Michael Niedermayer.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec/jpeg2000dec.c')
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 9f7c92fe44..83efab8bc4 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -663,6 +663,12 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, cblk->lblock += llen; if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0) return ret; + if (ret > sizeof(cblk->data)) { + avpriv_request_sample(s->avctx, + "Block with lengthinc greater than %zu", + sizeof(cblk->data)); + return AVERROR_PATCHWELCOME; + } cblk->lengthinc = ret; cblk->npasses += newpasses; } |