[FFmpeg-cvslog] lavc/mjpegdec: Do not overread too short JFIF tags.
Carl Eugen Hoyos
git at videolan.org
Sun Jan 1 19:55:06 EET 2017
ffmpeg | branch: master | Carl Eugen Hoyos <cehoyos at ag.or.at> | Sun Jan 1 14:19:48 2017 +0100| [4acea512f36b96256535b45b1a7e723c61c89c31] | committer: Carl Eugen Hoyos
lavc/mjpegdec: Do not overread too short JFIF tags.
Fixes ticket #6055.
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=4acea512f36b96256535b45b1a7e723c61c89c31
---
libavcodec/mjpegdec.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index eee8d58..e0b22ec 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1670,6 +1670,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
if (id == AV_RB32("JFIF")) {
int t_w, t_h, v1, v2;
+ if (len < 8)
+ goto out;
skip_bits(&s->gb, 8); /* the trailing zero-byte */
v1 = get_bits(&s->gb, 8);
v2 = get_bits(&s->gb, 8);
More information about the ffmpeg-cvslog
mailing list