virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

mjpegdec: check for packed rgb mjpeg.

Browse Source 
Fixes null pointer dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-02-21 00:00:51 +01:00
parent c4dc6c4c86
commit 47e92153b6
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
libavcodec/mjpegdec.c
View File

@ -299,10 +299,6 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
return AVERROR_PATCHWELCOME; return AVERROR_PATCHWELCOME;
} }
if (s->v_max == 1 && s->h_max == 1 && s->lossless==1 && nb_components==3)
s->rgb = 1;
else if (!s->lossless)
s->rgb = 0;
/* if different size, realloc/alloc picture */ /* if different size, realloc/alloc picture */
if ( width != s->width || height != s->height if ( width != s->width || height != s->height
@ -340,6 +336,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
} else{ } else{
if (s->v_max == 1 && s->h_max == 1 && s->lossless==1 && nb_components==3)
s->rgb = 1;
else if (!s->lossless)
s->rgb = 0;
/* XXX: not complete test ! */ /* XXX: not complete test ! */
pix_fmt_id = (s->h_count[0] << 28) | (s->v_count[0] << 24) | pix_fmt_id = (s->h_count[0] << 28) | (s->v_count[0] << 24) |
(s->h_count[1] << 20) | (s->v_count[1] << 16) | (s->h_count[1] << 20) | (s->v_count[1] << 16) |
@ -466,6 +466,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len); av_log(s->avctx, AV_LOG_DEBUG, "decode_sof0: error, len(%d) mismatch\n", len);
} }
if (s->rgb && !s->lossless && !s->ls) {
av_log(s->avctx, AV_LOG_ERROR, "Unsupported coding and pixel format combination\n");
return AVERROR_PATCHWELCOME;
}
/* totally blank picture as progressive JPEG will only add details to it */ /* totally blank picture as progressive JPEG will only add details to it */
if (s->progressive) { if (s->progressive) {
int bw = (width + s->h_max * 8 - 1) / (s->h_max * 8); int bw = (width + s->h_max * 8 - 1) / (s->h_max * 8);