diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2010-10-21 22:44:44 +0000 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2010-10-21 22:44:44 +0000 |
| commit | 2111a191ebec422cf7781225cbcfdd69e71afce1 (patch) | |
| tree | 7e67b4dec1e36cb4d098eaab1af49805a4dd6430 /libavcodec | |
| parent | 5675a11f9277b5c7b1c9ad45da893e9ef9a42f03 (diff) | |
Check index in mjpeg AC decode against overflowing.
This fixes a possibly exploitable buffer overflow and it will likely also be needed for future overreading fixes.
Originally committed as revision 25546 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec')
| -rw-r--r-- | libavcodec/mjpegdec.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index ec798594f4..ce52a08e83 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -411,7 +411,7 @@ static int decode_block(MJpegDecodeContext *s, DCTELEM *block, /* AC coefs */ i = 0; {OPEN_READER(re, &s->gb) - for(;;) { + do { UPDATE_CACHE(re, &s->gb); GET_VLC(code, re, &s->gb, s->vlcs[1][ac_index].table, 9, 2) @@ -444,7 +444,7 @@ static int decode_block(MJpegDecodeContext *s, DCTELEM *block, j = s->scantable.permutated[i]; block[j] = level * quant_matrix[j]; } - } + }while(i<63); CLOSE_READER(re, &s->gb)} return 0; @@ -511,6 +511,10 @@ static int decode_block_progressive(MJpegDecodeContext *s, DCTELEM *block, uint8 }else{ if(run == 0xF){// ZRL - skip 15 coefficients i += 15; + if (i >= se) { + av_log(s->avctx, AV_LOG_ERROR, "ZRL overflow: %d\n", i); + return -1; + } }else{ val = (1 << run); if(run){ |