From 1743938df10dd888484f964d5af8fd3957d26809 Mon Sep 17 00:00:00 2001 From: Martin Storsjö Date: Tue, 11 Sep 2012 14:41:42 +0300 Subject: rtpdec_jpeg: Disallow using the reserved q values MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Martin Storsjö --- libavformat/rtpdec_jpeg.c | 4 ++++ 1 file changed, 4 insertions(+) (limited to 'libavformat/rtpdec_jpeg.c') diff --git a/libavformat/rtpdec_jpeg.c b/libavformat/rtpdec_jpeg.c index 3f47e71bd3..3f53887798 100644 --- a/libavformat/rtpdec_jpeg.c +++ b/libavformat/rtpdec_jpeg.c @@ -304,6 +304,10 @@ static int jpeg_parse_packet(AVFormatContext *ctx, PayloadContext *jpeg, qtable_len = jpeg->qtables_len[q - 128]; } } else { /* q <= 127 */ + if (q == 0 || q > 99) { + av_log(ctx, AV_LOG_ERROR, "Reserved q value %d\n", q); + return AVERROR_INVALIDDATA; + } create_default_qtables(new_qtables, q); qtables = new_qtables; qtable_len = sizeof(new_qtables); -- cgit v1.2.3