[FFmpeg-cvslog] mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Luca Barbato git at videolan.org
Mon Jul 29 03:25:53 CEST 2013


ffmpeg | branch: release/0.10 | Luca Barbato <lu_zero at gentoo.org> | Wed May 15 18:41:41 2013 +0200| [7ca8d8223db270deb86d78b6361bec846feaaa9d] | committer: Reinhard Tartler

mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org
(cherry picked from commit cfbd98abe82cfcb9984a18d08697251b72b110c8)

Signed-off-by: Reinhard Tartler <siretart at tauware.de>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7ca8d8223db270deb86d78b6361bec846feaaa9d
---

 libavcodec/mjpegdec.c |    5 +++++
 1 file changed, 5 insertions(+)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 47c9899..5256a8e 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -963,6 +963,11 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
     int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
     GetBitContext mb_bitmask_gb;
 
+    if (ss < 0  || ss >= 64 ||
+        se < ss || se >= 64 ||
+        Ah < 0  || Al < 0)
+        return AVERROR_INVALIDDATA;
+
     if (mb_bitmask)
         init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);
 



More information about the ffmpeg-cvslog mailing list