aboutsummaryrefslogtreecommitdiffstats
path: root/libavformat/rsodec.c
diff options
context:
space:
mode:
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>2015-12-31 16:55:43 +0100
committerMichael Niedermayer <michael@niedermayer.cc>2016-01-15 17:39:04 +0100
commitf48392197d365f2a3a62e7ee8786fa4e9a41f3e9 (patch)
tree1ea8285c12c11415cb29be02dd38bad155c73560 /libavformat/rsodec.c
parentc1521dd418db3ad63019a7f7f2bbc985a3adf31c (diff)
downloadffmpeg-f48392197d365f2a3a62e7ee8786fa4e9a41f3e9.tar.gz
mjpegdec: extend check for incompatible values of s->rgb and s->ls
This can happen if s->ls changes from 0 to 1, but picture allocation is skipped due to s->interlaced. In that case ff_jpegls_decode_picture could be called even though the s->picture_ptr frame has the wrong pixel format and thus a wrong linesize, which results in a too small zero buffer being allocated. This fixes an out-of-bounds read in ls_decode_line. Reviewed-by: Michael Niedermayer <michael@niedermayer.cc> Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com> (cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072) Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
Diffstat (limited to 'libavformat/rsodec.c')
0 files changed, 0 insertions, 0 deletions