Browse code

avcodec/mjpegdec: check bits per pixel for changes similar to dimensions

Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 5c378d6a6df8243f06c87962b873bd563e58cd39)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2014/10/03 08:50:27
Showing 1 changed files
... ...
@@ -239,7 +239,7 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
239 239
 
240 240
 int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
241 241
 {
242
-    int len, nb_components, i, width, height, pix_fmt_id, ret;
242
+    int len, nb_components, i, width, height, bits, pix_fmt_id, ret;
243 243
     int h_count[MAX_COMPONENTS];
244 244
     int v_count[MAX_COMPONENTS];
245 245
 
... ...
@@ -249,11 +249,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
249 249
     /* XXX: verify len field validity */
250 250
     len     = get_bits(&s->gb, 16);
251 251
     s->avctx->bits_per_raw_sample =
252
-    s->bits = get_bits(&s->gb, 8);
252
+    bits = get_bits(&s->gb, 8);
253 253
 
254 254
     if (s->pegasus_rct)
255
-        s->bits = 9;
256
-    if (s->bits == 9 && !s->pegasus_rct)
255
+        bits = 9;
256
+    if (bits == 9 && !s->pegasus_rct)
257 257
         s->rct  = 1;    // FIXME ugly
258 258
 
259 259
     if(s->lossless && s->avctx->lowres){
... ...
@@ -283,7 +283,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
283 283
             return AVERROR_INVALIDDATA;
284 284
         }
285 285
     }
286
-    if (s->ls && !(s->bits <= 8 || nb_components == 1)) {
286
+    if (s->ls && !(bits <= 8 || nb_components == 1)) {
287 287
         avpriv_report_missing_feature(s->avctx,
288 288
                                       "JPEG-LS that is not <= 8 "
289 289
                                       "bits/component or 16-bit gray");
... ...
@@ -329,11 +329,13 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
329 329
 
330 330
     /* if different size, realloc/alloc picture */
331 331
     if (   width != s->width || height != s->height
332
+        || bits != s->bits
332 333
         || memcmp(s->h_count, h_count, sizeof(h_count))
333 334
         || memcmp(s->v_count, v_count, sizeof(v_count))) {
334 335
 
335 336
         s->width      = width;
336 337
         s->height     = height;
338
+        s->bits       = bits;
337 339
         memcpy(s->h_count, h_count, sizeof(h_count));
338 340
         memcpy(s->v_count, v_count, sizeof(v_count));
339 341
         s->interlaced = 0;