diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 17:57:17 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-31 18:34:08 +0100 |
| commit | 2884688bd51a808ccda3c0e13367619cd79e0579 (patch) | |
| tree | 67476bc1055452cc5719b31aa41e949b2206f3fd /libavcodec/mjpegbdec.c | |
| parent | 13aa82bbbb71c04bdcecf1341be4a23aee271bec (diff) | |
avcodec/mjpegdec: pass into ff_mjpeg_decode_sos() and check bitmask size
Fixes: heap array overread
Fixes: asan_heap-oob_149b2bc_6577_m1.mxg
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mjpegbdec.c')
| -rw-r--r-- | libavcodec/mjpegbdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c index f061f0bc26..61640952ff 100644 --- a/libavcodec/mjpegbdec.c +++ b/libavcodec/mjpegbdec.c @@ -119,7 +119,7 @@ read_header: 8 * FFMIN(field_size, buf_end - buf_ptr - sos_offs)); s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); s->start_code = SOS; - if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && + if (ff_mjpeg_decode_sos(s, NULL, 0, NULL) < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) return AVERROR_INVALIDDATA; } |