virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-11-26 19:01:44 +02:00
Code Issues Releases Activity

Check for out of bound reads in jpeg 2000 decoder.

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Laurent Aimar 2011-09-29 01:04:53 +02:00 committed by Michael Niedermayer
parent 41b7389cad
commit 02660a8713
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/j2kdec.c
View File

@ -961,18 +961,20 @@ static int decode_codestream(J2kDecoderContext *s)
static int jp2_find_codestream(J2kDecoderContext *s)
{
int32_t atom_size;
uint32_t atom_size;
int found_codestream = 0, search_range = 10;
// skip jpeg2k signature atom
s->buf += 12;
while(!found_codestream && search_range) {
while(!found_codestream && search_range && s->buf_end - s->buf >= 8) {
atom_size = AV_RB32(s->buf);
if(AV_RB32(s->buf + 4) == JP2_CODESTREAM) {
found_codestream = 1;
s->buf += 8;
} else {
if (s->buf_end - s->buf < atom_size)
return 0;
s->buf += atom_size;
search_range--;
}
@ -1005,7 +1007,8 @@ static int decode_frame(AVCodecContext *avctx,
return AVERROR(EINVAL);
// check if the image is in jp2 format
if((AV_RB32(s->buf) == 12) && (AV_RB32(s->buf + 4) == JP2_SIG_TYPE) &&
if(s->buf_end - s->buf >= 12 &&
(AV_RB32(s->buf) == 12) && (AV_RB32(s->buf + 4) == JP2_SIG_TYPE) &&
(AV_RB32(s->buf + 8) == JP2_SIG_VALUE)) {
if(!jp2_find_codestream(s)) {
av_log(avctx, AV_LOG_ERROR, "couldn't find jpeg2k codestream atom\n");