diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2013-06-30 14:04:22 +0200 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2013-06-30 14:11:38 +0200 |
commit | afddf0d9105d2e4f7e6abfab2613fd7ba5747daf (patch) | |
tree | a7a1c9d3e24db46f47369fec2f480dab4132a290 /libavcodec/mjpegdec.c | |
parent | e3fb8ac9564b6a3d86c5f60c940f2056a4faae56 (diff) | |
parent | 6765ee7b9cba46818a45b051438b2552f0a1b70a (diff) | |
download | ffmpeg-afddf0d9105d2e4f7e6abfab2613fd7ba5747daf.tar.gz |
Merge remote-tracking branch 'qatar/master'
* qatar/master:
mjpeg: Check the unescaped size for overflows
Conflicts:
libavcodec/mjpegdec.c
See: a9456c7c5ca883b5a3947e59a9fba5587e18e119
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mjpegdec.c')
-rw-r--r-- | libavcodec/mjpegdec.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 6de2bafc4b..7321b7f18c 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1662,14 +1662,18 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame, /* EOF */ if (start_code < 0) { goto the_end; - } else if (unescaped_buf_size > (1U<<28)) { - av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n", + } else if (unescaped_buf_size > INT_MAX / 8) { + av_log(avctx, AV_LOG_ERROR, + "MJPEG packet 0x%x too big (%d/%d), corrupt data?\n", start_code, unescaped_buf_size, buf_size); return AVERROR_INVALIDDATA; } av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\n", start_code, buf_end - buf_ptr); - if ((ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size)) < 0) { + + ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size); + + if (ret < 0) { av_log(avctx, AV_LOG_ERROR, "invalid buffer\n"); goto fail; } |