virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2024-12-23 12:43:46 +02:00
Code Issues Releases Activity

avcodec/mjpegdec: check that index is not negative

Browse Source
This commit is contained in:
Paul B Mahol 2022-09-25 19:17:25 +02:00
parent d31013166a
commit 4f022e6782
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
libavcodec/mjpegdec.c
View File

@ -373,7 +373,10 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
s->v_max = 1; s->v_max = 1;
for (i = 0; i < nb_components; i++) { for (i = 0; i < nb_components; i++) {
/* component id */ /* component id */
s->component_id[i] = get_bits(&s->gb, 8) - 1; int id = get_bits(&s->gb, 8);
if (id == 0)
return AVERROR_INVALIDDATA;
s->component_id[i] = id - 1;
h_count[i] = get_bits(&s->gb, 4); h_count[i] = get_bits(&s->gb, 4);
v_count[i] = get_bits(&s->gb, 4); v_count[i] = get_bits(&s->gb, 4);
/* compute hmax and vmax (only used in interleaved case) */ /* compute hmax and vmax (only used in interleaved case) */
@ -1677,7 +1680,10 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;
} }
for (i = 0; i < nb_components; i++) { for (i = 0; i < nb_components; i++) {
id = get_bits(&s->gb, 8) - 1; id = get_bits(&s->gb, 8);
if (id == 0)
return AVERROR_INVALIDDATA;
id -= 1;
av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id); av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
/* find component index */ /* find component index */
for (index = 0; index < s->nb_components; index++) for (index = 0; index < s->nb_components; index++)