Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c378d6a6df8243f06c87962b873bd563e58cd39)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
... | ... |
@@ -239,7 +239,7 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s) |
239 | 239 |
|
240 | 240 |
int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
241 | 241 |
{ |
242 |
- int len, nb_components, i, width, height, pix_fmt_id, ret; |
|
242 |
+ int len, nb_components, i, width, height, bits, pix_fmt_id, ret; |
|
243 | 243 |
int h_count[MAX_COMPONENTS]; |
244 | 244 |
int v_count[MAX_COMPONENTS]; |
245 | 245 |
|
... | ... |
@@ -249,11 +249,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
249 | 249 |
/* XXX: verify len field validity */ |
250 | 250 |
len = get_bits(&s->gb, 16); |
251 | 251 |
s->avctx->bits_per_raw_sample = |
252 |
- s->bits = get_bits(&s->gb, 8); |
|
252 |
+ bits = get_bits(&s->gb, 8); |
|
253 | 253 |
|
254 | 254 |
if (s->pegasus_rct) |
255 |
- s->bits = 9; |
|
256 |
- if (s->bits == 9 && !s->pegasus_rct) |
|
255 |
+ bits = 9; |
|
256 |
+ if (bits == 9 && !s->pegasus_rct) |
|
257 | 257 |
s->rct = 1; // FIXME ugly |
258 | 258 |
|
259 | 259 |
if(s->lossless && s->avctx->lowres){ |
... | ... |
@@ -283,7 +283,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
283 | 283 |
return AVERROR_INVALIDDATA; |
284 | 284 |
} |
285 | 285 |
} |
286 |
- if (s->ls && !(s->bits <= 8 || nb_components == 1)) { |
|
286 |
+ if (s->ls && !(bits <= 8 || nb_components == 1)) { |
|
287 | 287 |
avpriv_report_missing_feature(s->avctx, |
288 | 288 |
"JPEG-LS that is not <= 8 " |
289 | 289 |
"bits/component or 16-bit gray"); |
... | ... |
@@ -329,11 +329,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
329 | 329 |
|
330 | 330 |
/* if different size, realloc/alloc picture */ |
331 | 331 |
if ( width != s->width || height != s->height |
332 |
+ || bits != s->bits |
|
332 | 333 |
|| memcmp(s->h_count, h_count, sizeof(h_count)) |
333 | 334 |
|| memcmp(s->v_count, v_count, sizeof(v_count))) { |
334 | 335 |
|
335 | 336 |
s->width = width; |
336 | 337 |
s->height = height; |
338 |
+ s->bits = bits; |
|
337 | 339 |
memcpy(s->h_count, h_count, sizeof(h_count)); |
338 | 340 |
memcpy(s->v_count, v_count, sizeof(v_count)); |
339 | 341 |
s->interlaced = 0; |