summaryrefslogtreecommitdiffstats
path: root/libavcodec/mjpegdec.c
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2011-04-21 22:03:24 +0200
committerReinhard Tartler <siretart@tauware.de>2011-04-26 09:29:08 +0200
commit76cd98b445c5a1608e9a5974bef0b0be6b35f1ce (patch)
tree1dce7bafdab6266fb8f4c6b554d7e3f1d39ba913 /libavcodec/mjpegdec.c
parent4bc282322ba1c03ed98737740f6b5e17b604ffa1 (diff)
downloadffmpeg-streaming-76cd98b445c5a1608e9a5974bef0b0be6b35f1ce.zip
ffmpeg-streaming-76cd98b445c5a1608e9a5974bef0b0be6b35f1ce.tar.gz
mjpeg: Detect overreads in mjpeg_decode_scan() and error out.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at> Signed-off-by: Ronald S. Bultje <rbultje@google.com>
Diffstat (limited to 'libavcodec/mjpegdec.c')
-rw-r--r--libavcodec/mjpegdec.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 6f29e46..fa2c505 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -826,6 +826,10 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
if (s->restart_interval && !s->restart_count)
s->restart_count = s->restart_interval;
+ if(get_bits_count(&s->gb)>s->gb.size_in_bits){
+ av_log(s->avctx, AV_LOG_ERROR, "overread %d\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+ return -1;
+ }
for(i=0;i<nb_components;i++) {
uint8_t *ptr;
int n, h, v, x, y, c, j;
OpenPOWER on IntegriCloud