diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-07-01 10:01:08 +0200 |
|---|---|---|
| committer | Luca Barbato <lu_zero@gentoo.org> | 2013-07-02 20:05:44 +0200 |
| commit | fd54dd028bc9f7bfb80ebf823a533dc84b73f936 (patch) | |
| tree | 91d5f1c54990f6090895ffcdbb9fe8f1e115dd0e /libavcodec/jpeg2000dec.c | |
| parent | eae63e3c156f784ee0612422f0c95131ea913c14 (diff) | |
jpeg2000: check len before parsing header
Avoid overread.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
Diffstat (limited to 'libavcodec/jpeg2000dec.c')
| -rw-r--r-- | libavcodec/jpeg2000dec.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 8cc1094fee..e1da04d0c6 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -1241,9 +1241,10 @@ static int jpeg2000_read_main_headers(Jpeg2000DecoderContext *s) if (marker == JPEG2000_EOC) break; - if (bytestream2_get_bytes_left(&s->g) < 2) - return AVERROR_INVALIDDATA; len = bytestream2_get_be16u(&s->g); + if (len < 2 || bytestream2_get_bytes_left(&s->g) < len - 2) + return AVERROR_INVALIDDATA; + switch (marker) { case JPEG2000_SIZ: ret = get_siz(s); |