diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-05-22 02:29:00 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-05-22 02:29:49 +0200 |
| commit | fec8783883f789802ba6596ce4c324aa5c040754 (patch) | |
| tree | 6b0c9c741a2f687bb37f5daad49a42480c311031 /libavcodec | |
| parent | f399b33c2bb7a25b0a60d50afc81d5e1967ca35a (diff) | |
| download | ffmpeg-fec8783883f789802ba6596ce4c324aa5c040754.tar.gz | |
jpeg2000dec: read and check curtileno
Fixes out of array accesses
Code ported from j2kdec
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 4768f7eef0..4e03e0ebe2 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -416,7 +416,11 @@ static int get_sot(Jpeg2000DecoderContext *s, int n) if (bytestream2_get_bytes_left(&s->g) < 8) return AVERROR(EINVAL); - Isot = bytestream2_get_be16u(&s->g); // Isot + s->curtileno = Isot = bytestream2_get_be16u(&s->g); // Isot + if((unsigned)s->curtileno >= s->numXtiles * s->numYtiles){ + s->curtileno=0; + return AVERROR(EINVAL); + } if (Isot) { av_log(s->avctx, AV_LOG_ERROR, "Not a DCINEMA JP2K file: more than one tile\n"); |