From 7e201d575dc4385eb67314b0419d4d77185e65f4 Mon Sep 17 00:00:00 2001 From: Luca Barbato Date: Mon, 1 Jul 2013 10:01:05 +0200 Subject: jpeg2000: Validate block lengthinc Currently we are using an array with a static data size. Similar to a patch with the same purpose by Michael Niedermayer. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato --- libavcodec/jpeg2000dec.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'libavcodec/jpeg2000dec.c') diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 9f7c92fe44..83efab8bc4 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -663,6 +663,12 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, cblk->lblock += llen; if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0) return ret; + if (ret > sizeof(cblk->data)) { + avpriv_request_sample(s->avctx, + "Block with lengthinc greater than %zu", + sizeof(cblk->data)); + return AVERROR_PATCHWELCOME; + } cblk->lengthinc = ret; cblk->npasses += newpasses; } -- cgit v1.2.3