highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

mjpegdec: tighten unescaped_buf_size size check, prevent null ptr deref

Browse Source 
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2012-11-12 20:27:29 +01:00
parent abe68364a3
commit a9456c7c5c
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
libavcodec/mjpegdec.c
View File

@ -1611,7 +1611,7 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
/* EOF */ /* EOF */
if (start_code < 0) { if (start_code < 0) {
goto the_end; goto the_end;
} else if (unescaped_buf_size > (1U<<29)) { } else if (unescaped_buf_size > (1U<<28)) {
av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n", av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n",
start_code, unescaped_buf_size, buf_size); start_code, unescaped_buf_size, buf_size);
return AVERROR_INVALIDDATA; return AVERROR_INVALIDDATA;