diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2024-05-01 22:33:14 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2024-07-02 21:57:20 +0200 |
| commit | 385784a148d2886884aac69acc31bf179fac3ac2 (patch) | |
| tree | 5ef845311010fb146fe626eb6b13c03ef8237108 /libavcodec | |
| parent | 4bca1474157f19cbf80a64f055ecd655060f9f1b (diff) | |
| download | ffmpeg-385784a148d2886884aac69acc31bf179fac3ac2.tar.gz | |
avcodec/cbs_jpeg: Try to move the read entity to one side in a test
The checked entity should be alone on one side of the check, this avoids
complex considerations of overflows.
This fixes a issue of bad style in our code and a coverity issue.
Fixes: CID1439654 Untrusted pointer read
Sponsored-by: Sovereign Tech Fund
Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/cbs_jpeg.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/cbs_jpeg.c b/libavcodec/cbs_jpeg.c index b1b58dcd65..406147c082 100644 --- a/libavcodec/cbs_jpeg.c +++ b/libavcodec/cbs_jpeg.c @@ -146,13 +146,13 @@ static int cbs_jpeg_split_fragment(CodedBitstreamContext *ctx, } } else { i = start; - if (i + 2 > frag->data_size) { + if (i > frag->data_size - 2) { av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: " "truncated at %02x marker.\n", marker); return AVERROR_INVALIDDATA; } length = AV_RB16(frag->data + i); - if (i + length > frag->data_size) { + if (length > frag->data_size - i) { av_log(ctx->log_ctx, AV_LOG_ERROR, "Invalid JPEG image: " "truncated at %02x marker segment.\n", marker); return AVERROR_INVALIDDATA; |