ffmpeg/libavcodec
Andreas Cadhalpun a5fb5a18e3 mjpegdec: extend check for incompatible values of s->rgb and s->ls
This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
2016-01-15 17:23:54 +01:00
..
2015-03-06 14:37:44 +01:00
2015-03-13 13:04:31 +01:00
2015-03-03 13:57:42 +01:00
2015-07-20 04:43:39 +02:00
2015-02-21 20:38:13 +01:00
2015-07-20 04:43:39 +02:00
2015-05-15 20:40:26 +02:00
2015-11-19 03:51:37 +01:00
2015-03-28 20:01:22 +01:00
2015-03-14 14:26:28 +01:00
2015-12-20 15:06:10 +01:00
2015-03-02 19:32:23 +01:00
2015-07-23 01:37:36 +02:00
2015-02-27 09:30:13 +00:00
2015-07-23 01:35:29 +02:00
2015-11-26 01:37:33 +01:00
2015-11-19 03:51:38 +01:00
2015-02-24 03:15:42 +01:00
2015-11-19 03:51:37 +01:00
2015-05-15 10:04:51 +02:00