highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avcodec/mjpegdec: Check len in ff_mjpeg_decode_dqt()

Browse Source 
Fixes CID1239060

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2015-05-13 16:51:20 +02:00
parent 6d3f17838d
commit dc35a58149
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/mjpegdec.c
View File

@@ -163,6 +163,11 @@ int ff_mjpeg_decode_dqt(MJpegDecodeContext *s)
len = get_bits(&s->gb, 16) - 2; len = get_bits(&s->gb, 16) - 2;
if (8*len > get_bits_left(&s->gb)) {
av_log(s->avctx, AV_LOG_ERROR, "dqt: len %d is too large\n", len);
return AVERROR_INVALIDDATA;
}
while (len >= 65) { while (len >= 65) {
int pr = get_bits(&s->gb, 4); int pr = get_bits(&s->gb, 4);
if (pr > 1) { if (pr > 1) {