MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/smvjpegdec: check that frames_per_jpeg cleanly divides height

Browse Source 
Fixes out of array access

If some valid files fail this check then please open a ticket and ping me and the smvjpegdec maintainer.

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-06-07 20:36:48 +02:00
parent 0ea1356137
commit 467e7a8f26
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
libavcodec/smvjpegdec.c
View File

@ -124,6 +124,7 @@ static av_cold int smvjpeg_decode_init(AVCodecContext *avctx)
static int smvjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
AVPacket *avpkt)
{
const AVPixFmtDescriptor *desc;
SMVJpegDecodeContext *s = avctx->priv_data;
AVFrame* mjpeg_data = s->picture[0];
int i, cur_frame = 0, ret = 0;
@ -134,6 +135,12 @@ static int smvjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_siz
if (!cur_frame)
ret = avcodec_decode_video2(s->avctx, mjpeg_data, &s->mjpeg_data_size, avpkt);
desc = av_pix_fmt_desc_get(s->avctx->pix_fmt);
if (desc && mjpeg_data->height % (s->frames_per_jpeg << desc->log2_chroma_h)) {
av_log(avctx, AV_LOG_ERROR, "Invalid height\n");
return AVERROR_INVALIDDATA;
}
/*use the last lot... */
*data_size = s->mjpeg_data_size;