From: Michael Niedermayer <[email protected]>
On 2012-01-05 09:51:51 +0100, Diego Biurrun wrote:
> On Thu, Jan 05, 2012 at 03:47:21AM +0100, Janne Grunau wrote:
> >
> > Check explicitly if enough bits are left to prevent an infinite loop
> > caused by all setted bits after the bitstream buffer.
>
> Either
>
> caused by all bits set after the bitstream buffer.
>
> or
>
> caused by all bits being set after the bitstream buffer.
>
> depending on what you want to say.
or something else entirely. Was too late.
Janne
---8<---
Check explicitly if enough bits are left to prevent an infinite loop
when the bitstream buffer is not followed by zero-padding.
---
libavcodec/mjpegdec.c | 24 ++++++++++++++++--------
1 files changed, 16 insertions(+), 8 deletions(-)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 058b08f..7a85c16 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -881,14 +881,22 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int
nb_components, int Ah, i
}
}
- if (s->restart_interval && show_bits(&s->gb, 8) == 0xFF){ /* skip
RSTn */
- --s->restart_count;
- align_get_bits(&s->gb);
- while(show_bits(&s->gb, 8) == 0xFF)
- skip_bits(&s->gb, 8);
- skip_bits(&s->gb, 8);
- for (i=0; i<nb_components; i++) /* reset dc */
- s->last_dc[i] = 1024;
+ if (s->restart_interval) {
+ s->restart_count--;
+ i = 8 + ((-get_bits_count(&s->gb)) & 7);
+ /* skip RSTn */
+ if (show_bits(&s->gb, i) == (1 << i) - 1) {
+ int pos = get_bits_count(&s->gb);
+ align_get_bits(&s->gb);
+ while (get_bits_left(&s->gb) >= 8 && show_bits(&s->gb, 8)
== 0xFF)
+ skip_bits(&s->gb, 8);
+ if ((get_bits(&s->gb, 8) & 0xF8) == 0xD0) {
+ for (i = 0; i < nb_components; i++) /* reset dc */
+ s->last_dc[i] = 1024;
+ } else {
+ skip_bits_long(&s->gb, pos - get_bits_count(&s->gb));
+ }
+ }
}
}
}
--
1.7.8.2
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
