1. ffmpeg
  2. Commit c17fd9f9ce2eb2e4bd11045faa4d6ae8b1fe8e1c
Browse code

avcodec/mjpegdec: Add some sanity checks to ljpeg_decode_rgb_scan()

These prevent the rgb ljpeg code from being run on parameters that it doesnt
support. No testcase available but it seems possible to trigger these.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 61c68000eda643dfce96dc46b488d39fd5c4e309)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

Michael Niedermayer authored on 2013/09/05 07:36:44
Showing 1 changed files
libavcodec/mjpegdec.c
History View file @ c17fd9f
... ... 
@@ -774,6 +774,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
774 774 
     int resync_mb_y = 0;
775 775 
     int resync_mb_x = 0;
776 776
777 
+    if (s->nb_components != 3 && s->nb_components != 4)
778 
+        return AVERROR_INVALIDDATA;
779 
+    if (s->v_max != 1 || s->h_max != 1 || !s->lossless)
780 
+        return AVERROR_INVALIDDATA;
781 
+
782 
+
777 783 
     s->restart_count = s->restart_interval;
778 784
779 785 
     av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size,