From 5d171b1f4718ae2916dfddc35299ccdef1e3001c Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Tue, 3 Jul 2012 11:56:55 +0000 Subject: jvdec: check if there is enough data Signed-off-by: Paul B Mahol --- libavcodec/jvdec.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) (limited to 'libavcodec/jvdec.c') diff --git a/libavcodec/jvdec.c b/libavcodec/jvdec.c index a8c3336ccc..f2a874409c 100644 --- a/libavcodec/jvdec.c +++ b/libavcodec/jvdec.c @@ -137,6 +137,9 @@ static int decode_frame(AVCodecContext *avctx, const uint8_t *buf_end = buf + avpkt->size; int video_size, video_type, i, j; + if (avpkt->size < 6) + return AVERROR_INVALIDDATA; + video_size = AV_RL32(buf); video_type = buf[4]; buf += 5; @@ -162,11 +165,9 @@ static int decode_frame(AVCodecContext *avctx, buf += video_size; } else if (video_type == 2) { - if (buf + 1 <= buf_end) { - int v = *buf++; - for (j = 0; j < avctx->height; j++) - memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width); - } + int v = *buf++; + for (j = 0; j < avctx->height; j++) + memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width); } else { av_log(avctx, AV_LOG_WARNING, "unsupported frame type %i\n", video_type); return AVERROR_INVALIDDATA; -- cgit v1.2.3