virtualenv/FFmpeg
1
0
Fork 0
mirror of https://github.com/FFmpeg/FFmpeg.git synced 2025-01-08 13:22:53 +02:00
Code Issues Releases Activity

mjpegbdec: check SOS/SOF ordering.

Browse Source 
Fixes null ptr dereference

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-04-22 14:19:18 +02:00
parent abec6549ae
commit 9a4f5b7616
2 changed files with 8 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libavcodec/mjpegbdec.c
View File

@ -52,6 +52,7 @@ static int mjpegb_decode_frame(AVCodecContext *avctx,
buf_ptr = buf; buf_ptr = buf;
buf_end = buf + buf_size; buf_end = buf + buf_size;
s->got_picture = 0;
read_header: read_header:
/* reset on every SOI */ /* reset on every SOI */

12
libavcodec/mjpegdec.c
View File

@ -1148,6 +1148,13 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
const int block_size = s->lossless ? 1 : 8; const int block_size = s->lossless ? 1 : 8;
int ilv, prev_shift; int ilv, prev_shift;
if (!s->got_picture) {
av_log(s->avctx, AV_LOG_WARNING,
"Can not process SOS before SOF, skipping\n");
return -1;
}
av_assert0(s->picture_ptr->data[0]);
/* XXX: verify len field validity */ /* XXX: verify len field validity */
len = get_bits(&s->gb, 16); len = get_bits(&s->gb, 16);
nb_components = get_bits(&s->gb, 8); nb_components = get_bits(&s->gb, 8);
@ -1699,11 +1706,6 @@ eoi_parser:
goto the_end; goto the_end;
case SOS: case SOS:
if (!s->got_picture) {
av_log(avctx, AV_LOG_WARNING,
"Can not process SOS before SOF, skipping\n");
break;
}
if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
(avctx->err_recognition & AV_EF_EXPLODE)) (avctx->err_recognition & AV_EF_EXPLODE))
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;