Module: libav Branch: master Commit: 7e201d575dc4385eb67314b0419d4d77185e65f4
Author: Luca Barbato <[email protected]> Committer: Luca Barbato <[email protected]> Date: Mon Jul 1 10:01:05 2013 +0200 jpeg2000: Validate block lengthinc Currently we are using an array with a static data size. Similar to a patch with the same purpose by Michael Niedermayer. Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Luca Barbato <[email protected]> --- libavcodec/jpeg2000dec.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c index 9f7c92f..83efab8 100644 --- a/libavcodec/jpeg2000dec.c +++ b/libavcodec/jpeg2000dec.c @@ -663,6 +663,12 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s, cblk->lblock += llen; if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0) return ret; + if (ret > sizeof(cblk->data)) { + avpriv_request_sample(s->avctx, + "Block with lengthinc greater than %zu", + sizeof(cblk->data)); + return AVERROR_PATCHWELCOME; + } cblk->lengthinc = ret; cblk->npasses += newpasses; } _______________________________________________ libav-commits mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-commits
