diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-13 23:50:35 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-02-14 01:22:38 +0100 |
| commit | 00ab9cdae1a96dfea33cd505076a83823f390aa4 (patch) | |
| tree | 6d118847eaef274bc1e72c26fcb50cfc87cb0755 /libavcodec/jpeglsdec.c | |
| parent | dda713f8707ee291670092fe808552246bade728 (diff) | |
| download | ffmpeg-00ab9cdae1a96dfea33cd505076a83823f390aa4.tar.gz | |
jpeglsdec: Prevent out of array write.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/jpeglsdec.c')
| -rw-r--r-- | libavcodec/jpeglsdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index 0139c8860f..74714e0521 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -198,6 +198,9 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s, void * r = ff_log2_run[state->run_index[comp]]; if(r) r = get_bits_long(&s->gb, r); + if(x + r * stride > w) { + r = (w - x) / stride; + } for(i = 0; i < r; i++) { W(dst, x, Ra); x += stride; |