virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-10-30 23:18:11 +02:00
Code Issues Releases Activity

Fix heap overflow due to lack of nb_components check.

Browse Source 
Originally committed as revision 21450 to svn://svn.ffmpeg.org/ffmpeg/trunk
This commit is contained in:
Michael Niedermayer
2010-01-25 13:26:10 +00:00
parent cc5d4f4c34
commit 021dccba1f
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavcodec/mjpegdec.c
View File

@@ -899,6 +899,10 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s)
/* XXX: verify len field validity */ /* XXX: verify len field validity */
len = get_bits(&s->gb, 16); len = get_bits(&s->gb, 16);
nb_components = get_bits(&s->gb, 8); nb_components = get_bits(&s->gb, 8);
if (nb_components == 0 || nb_components > MAX_COMPONENTS){
av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\n", nb_components);
return -1;
}
if (len != 6+2*nb_components) if (len != 6+2*nb_components)
{ {
av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len); av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len);