1. ffmpeg
  2. Commit fd6a9fcd427b86c0a249a8cdb33f746f33706725
Browse code

avcodec/mjpegdec: Check number of components for JPEG-LS

Fixes out of array accesses
Fixes: asan_heap-oob_1c1a4ea_1242_cov_2274415971_TESTcmyk.jpg

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fabbfaa095660982cc0bc63242c459561fa37037)

Conflicts:

libavcodec/mjpegdec.c

Michael Niedermayer authored on 2015/02/05 04:48:30
Showing 1 changed files
libavcodec/mjpegdec.c
History View file @ fd6a9fc
... ... 
@@ -437,9 +437,12 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
437 437 
     }
438 438 
     if (s->ls) {
439 439 
         s->upscale_h = s->upscale_v = 0;
440 
-        if (s->nb_components > 1)
440 
+        if (s->nb_components == 3) {
441 441 
             s->avctx->pix_fmt = AV_PIX_FMT_RGB24;
442 
-        else if (s->bits <= 8)
442 
+        } else if (s->nb_components != 1) {
443 
+            av_log(s->avctx, AV_LOG_ERROR, "Unsupported number of components %d\n", s->nb_components);
444 
+            return AVERROR_PATCHWELCOME;
445 
+        } else if (s->bits <= 8)
443 446 
             s->avctx->pix_fmt = AV_PIX_FMT_GRAY8;
444 447 
         else
445 448 
             s->avctx->pix_fmt = AV_PIX_FMT_GRAY16;