Browse code
avcodec/mjpegdec: Check escape sequence validity
Fixes assertion failure
Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Michael Niedermayer authored on 2015/02/05 04:13:18Showing 1 changed files
| ... | ... |
@@ -1631,6 +1631,10 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s, |
| 1631 | 1631 |
put_bits(&pb, 8, x); |
| 1632 | 1632 |
if (x == 0xFF) {
|
| 1633 | 1633 |
x = src[b++]; |
| 1634 |
+ if (x & 0x80) {
|
|
| 1635 |
+ av_log(s->avctx, AV_LOG_WARNING, "Invalid escape sequence\n"); |
|
| 1636 |
+ x &= 0x7f; |
|
| 1637 |
+ } |
|
| 1634 | 1638 |
put_bits(&pb, 7, x); |
| 1635 | 1639 |
bit_count--; |
| 1636 | 1640 |
} |