MrBesen/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avcodec/mjpegdec: Check len in ff_mjpeg_decode_dht()

Browse Source 
Fixes CID1239167

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2015-05-13 17:41:41 +02:00
parent dc35a58149
commit cf9ab119d0
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
libavcodec/mjpegdec.c
View File

@ -204,6 +204,11 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
len = get_bits(&s->gb, 16) - 2;
if (8*len > get_bits_left(&s->gb)) {
av_log(s->avctx, AV_LOG_ERROR, "dht: len %d is too large\n", len);
return AVERROR_INVALIDDATA;
}
while (len > 0) {
if (len < 17)
return AVERROR_INVALIDDATA;