diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2011-12-24 06:17:12 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-12-24 18:51:36 +0100 |
| commit | 282bb02839b1ce73963c8e3ee46804f1ade8b12a (patch) | |
| tree | ed643880e5e0c98556bad2cbf8519e1b014b7b3b /libavcodec/j2kdec.c | |
| parent | 3eedf9f716733b3b4c5205726d2c1ca52b3d3d78 (diff) | |
j2kdec: Fix crash in get_qcx
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/j2kdec.c')
| -rw-r--r-- | libavcodec/j2kdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/j2kdec.c b/libavcodec/j2kdec.c index 4e11030cb8..e35c97d860 100644 --- a/libavcodec/j2kdec.c +++ b/libavcodec/j2kdec.c @@ -365,7 +365,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q) if (q->quantsty == J2K_QSTY_NONE){ n -= 3; - if (s->buf_end - s->buf < n) + if (s->buf_end - s->buf < n || 32*3 < n) return AVERROR(EINVAL); for (i = 0; i < n; i++) q->expn[i] = bytestream_get_byte(&s->buf) >> 3; @@ -382,7 +382,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q) } } else{ n = (n - 3) >> 1; - if (s->buf_end - s->buf < n) + if (s->buf_end - s->buf < n || 32*3 < n) return AVERROR(EINVAL); for (i = 0; i < n; i++){ x = bytestream_get_be16(&s->buf); |