virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity

jpeg2000dec: dont set ncomponents to an invalid value

Browse Source 
Fixes out of array accesses

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-06-14 00:35:52 +02:00
parent ff0bdf9375
commit 129edcb50f
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/jpeg2000dec.c
View File

@ -160,6 +160,7 @@ static int tag_tree_decode(Jpeg2000DecoderContext *s, Jpeg2000TgtNode *node,
static int get_siz(Jpeg2000DecoderContext *s) static int get_siz(Jpeg2000DecoderContext *s)
{ {
int i; int i;
int ncomponents;
if (bytestream2_get_bytes_left(&s->g) < 36) if (bytestream2_get_bytes_left(&s->g) < 36)
return AVERROR(EINVAL); return AVERROR(EINVAL);
@ -173,12 +174,14 @@ static int get_siz(Jpeg2000DecoderContext *s)
s->tile_height = bytestream2_get_be32u(&s->g); // YTSiz s->tile_height = bytestream2_get_be32u(&s->g); // YTSiz
s->tile_offset_x = bytestream2_get_be32u(&s->g); // XT0Siz s->tile_offset_x = bytestream2_get_be32u(&s->g); // XT0Siz
s->tile_offset_y = bytestream2_get_be32u(&s->g); // YT0Siz s->tile_offset_y = bytestream2_get_be32u(&s->g); // YT0Siz
s->ncomponents = bytestream2_get_be16u(&s->g); // CSiz ncomponents = bytestream2_get_be16u(&s->g); // CSiz
if (s->ncomponents <= 0 || s->ncomponents > 4) { if (ncomponents <= 0 || ncomponents > 4) {
av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", s->ncomponents); av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", ncomponents);
return AVERROR(EINVAL); return AVERROR(EINVAL);
} }
s->ncomponents = ncomponents;
if (s->tile_width<=0 || s->tile_height<=0) if (s->tile_width<=0 || s->tile_height<=0)
return AVERROR(EINVAL); return AVERROR(EINVAL);