Merge remote-tracking branch 'qatar/master'

* qatar/master:
  mjpeg: Check the unescaped size for overflows

Conflicts:
	libavcodec/mjpegdec.c

See: a9456c7c5ca883b5a3947e59a9fba5587e18e119

Merged-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 7 insertions, 3 deletions

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 6de2bafc4b..7321b7f18c 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1662,14 +1662,18 @@ int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *got_frame,
         /* EOF */
         if (start_code < 0) {
             goto the_end;
-        } else if (unescaped_buf_size > (1U<<28)) {
-            av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n",
+        } else if (unescaped_buf_size > INT_MAX / 8) {
+            av_log(avctx, AV_LOG_ERROR,
+                   "MJPEG packet 0x%x too big (%d/%d), corrupt data?\n",
                    start_code, unescaped_buf_size, buf_size);
             return AVERROR_INVALIDDATA;
         }
         av_log(avctx, AV_LOG_DEBUG, "marker=%x avail_size_in_buf=%td\n",
                start_code, buf_end - buf_ptr);
-        if ((ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size)) < 0) {
+
+        ret = init_get_bits8(&s->gb, unescaped_buf_ptr, unescaped_buf_size);
+
+        if (ret < 0) {
             av_log(avctx, AV_LOG_ERROR, "invalid buffer\n");
             goto fail;
         }