diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2005-07-11 23:39:47 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2005-07-11 23:39:47 +0000 |
| commit | aa6ff39bb093a98b338cee45af77cd6c4055b886 (patch) | |
| tree | d45d0220d35b844640e1df0f77810ff1b928c660 /libavcodec | |
| parent | 1a55810e878efefe3b8c128d57af3a66949872e0 (diff) | |
| download | ffmpeg-aa6ff39bb093a98b338cee45af77cd6c4055b886.tar.gz | |
check len (should fix #1165694)
Originally committed as revision 4436 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mjpeg.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/libavcodec/mjpeg.c b/libavcodec/mjpeg.c index 4c2b4793bf..58b5b97823 100644 --- a/libavcodec/mjpeg.c +++ b/libavcodec/mjpeg.c @@ -1585,10 +1585,11 @@ static int mjpeg_decode_app(MJpegDecodeContext *s) { int len, id; - /* XXX: verify len field validity */ len = get_bits(&s->gb, 16); if (len < 5) return -1; + if(8*len + get_bits_count(&s->gb) > s->gb.size_in_bits) + return -1; id = (get_bits(&s->gb, 16) << 16) | get_bits(&s->gb, 16); id = be2me_32(id); |