diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 17:57:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 18:34:08 +0100 |
| commit | 2884688bd51a808ccda3c0e13367619cd79e0579 (patch) | |
| tree | 67476bc1055452cc5719b31aa41e949b2206f3fd /libavcodec/mxpegdec.c | |
| parent | 13aa82bbbb71c04bdcecf1341be4a23aee271bec (diff) | |
| download | ffmpeg-streaming-2884688bd51a808ccda3c0e13367619cd79e0579.zip ffmpeg-streaming-2884688bd51a808ccda3c0e13367619cd79e0579.tar.gz | |
avcodec/mjpegdec: pass into ff_mjpeg_decode_sos() and check bitmask size
Fixes: heap array overread
Fixes: asan_heap-oob_149b2bc_6577_m1.mxg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mxpegdec.c')
| -rw-r--r-- | libavcodec/mxpegdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c index 8eee3b8..155d348 100644 --- a/libavcodec/mxpegdec.c +++ b/libavcodec/mxpegdec.c @@ -295,11 +295,11 @@ static int mxpeg_decode_frame(AVCodecContext *avctx, AV_GET_BUFFER_FLAG_REF)) < 0) return ret; - ret = ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, reference_ptr); + ret = ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, s->bitmask_size, reference_ptr); if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) return ret; } else { - ret = ff_mjpeg_decode_sos(jpg, NULL, NULL); + ret = ff_mjpeg_decode_sos(jpg, NULL, 0, NULL); if (ret < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) return ret; } |
