From dc35a58149c27a3ae2d47a7a393a77a8987454ac Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Wed, 13 May 2015 16:51:20 +0200 Subject: avcodec/mjpegdec: Check len in ff_mjpeg_decode_dqt() Fixes CID1239060 Signed-off-by: Michael Niedermayer --- libavcodec/mjpegdec.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'libavcodec/mjpegdec.c') diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 2d6451ce90..2e019d99c5 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -163,6 +163,11 @@ int ff_mjpeg_decode_dqt(MJpegDecodeContext *s) len = get_bits(&s->gb, 16) - 2; + if (8*len > get_bits_left(&s->gb)) { + av_log(s->avctx, AV_LOG_ERROR, "dqt: len %d is too large\n", len); + return AVERROR_INVALIDDATA; + } + while (len >= 65) { int pr = get_bits(&s->gb, 4); if (pr > 1) { -- cgit v1.2.3