aboutsummaryrefslogtreecommitdiffstats
path: root/libavcodec/mjpegdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-06-30 14:04:22 +0200
committerMichael Niedermayer <michaelni@gmx.at>2013-06-30 14:11:38 +0200
commitafddf0d9105d2e4f7e6abfab2613fd7ba5747daf (patch)
treea7a1c9d3e24db46f47369fec2f480dab4132a290 /libavcodec/mjpegdec.c
parente3fb8ac9564b6a3d86c5f60c940f2056a4faae56 (diff)
parent6765ee7b9cba46818a45b051438b2552f0a1b70a (diff)
downloadffmpeg-afddf0d9105d2e4f7e6abfab2613fd7ba5747daf.tar.gz
Merge remote-tracking branch 'qatar/master'
* qatar/master: mjpeg: Check the unescaped size for overflows Conflicts: libavcodec/mjpegdec.c See: a9456c7c5ca883b5a3947e59a9fba5587e18e119 Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mjpegdec.c')
-rw-r--r--libavcodec/mjpegdec.c10
1 files changed, 7 insertions, 3 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 6de2bafc4b..7321b7f18c 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1662,14 +1662,18 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
/* EOF */
if (start_code < 0) {
goto the_end;
- } else if (unescaped_buf_size > (1U<<28)) {
- av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n",
+ } else if (unescaped_buf_size > INT_MAX / 8) {
+ av_log(avctx, AV_LOG_ERROR,
+ "MJPEG packet 0x%x too big (%d/%d), corrupt data?\n",
start_code, unescaped_buf_size, buf_size);
return AVERROR_INVALIDDATA;
}
av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\n",
start_code, buf_end - buf_ptr);
- if ((ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size)) < 0) {
+
+ ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size);
+
+ if (ret < 0) {
av_log(avctx, AV_LOG_ERROR, "invalid buffer\n");
goto fail;
}