highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

jvdec: check if there is enough data

Browse Source 
Signed-off-by: Paul B Mahol <onemda@gmail.com>
This commit is contained in:
Paul B Mahol 2012-07-03 11:56:55 +00:00
parent f8a81755c2
commit 5d171b1f47
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
libavcodec/jvdec.c
View File

@ -137,6 +137,9 @@ static int decode_frame(AVCodecContext *avctx,
const uint8_t *buf_end = buf + avpkt->size; const uint8_t *buf_end = buf + avpkt->size;
int video_size, video_type, i, j; int video_size, video_type, i, j;
if (avpkt->size < 6)
return AVERROR_INVALIDDATA;
video_size = AV_RL32(buf); video_size = AV_RL32(buf);
video_type = buf[4]; video_type = buf[4];
buf += 5; buf += 5;
@ -162,11 +165,9 @@ static int decode_frame(AVCodecContext *avctx,
buf += video_size; buf += video_size;
} else if (video_type == 2) { } else if (video_type == 2) {
if (buf + 1 <= buf_end) { int v = *buf++;
int v = *buf++; for (j = 0; j < avctx->height; j++)
for (j = 0; j < avctx->height; j++) memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width);
memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width);
}
} else { } else {
av_log(avctx, AV_LOG_WARNING, "unsupported frame type %i\n", video_type); av_log(avctx, AV_LOG_WARNING, "unsupported frame type %i\n", video_type);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;