From 2773ab36cc6480ce77845df0b1d1e2f790c59cde Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 9 Apr 2014 23:05:15 +0200 Subject: [PATCH] avcodec/jpeglsdec/ff_jpegls_decode_lse: check len field validity Signed-off-by: Michael Niedermayer --- libavcodec/jpeglsdec.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index 13b6e41d2a..d8e2bdbac0 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -52,11 +52,14 @@ int ff_jpegls_decode_lse(MJpegDecodeContext *s) int id; int tid, wt, maxtab, i, j; - int len = get_bits(&s->gb, 16); /* length: FIXME: verify field validity */ + int len = get_bits(&s->gb, 16); id = get_bits(&s->gb, 8); switch (id) { case 1: + if (len < 13) + return AVERROR_INVALIDDATA; + s->maxval = get_bits(&s->gb, 16); s->t1 = get_bits(&s->gb, 16); s->t2 = get_bits(&s->gb, 16);