In the fate sample field_size is larger than the number of bytes
remaining in the buffer. Furthermore the bytes to bits conversion was
prone to integer overflow when sizing the GetBitContext.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
---
libavcodec/mjpegbdec.c | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c
index 4ad17ab..42ece01 100644
--- a/libavcodec/mjpegbdec.c
+++ b/libavcodec/mjpegbdec.c
@@ -111,8 +111,8 @@ read_header:
av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
if (sos_offs)
{
-// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8);
- init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8);
+ unsigned gb_size = FFMIN(buf_end - buf_ptr - sos_offs, (1<<28) - 1) *
8;
+ init_get_bits(&s->gb, buf_ptr + sos_offs, gb_size);
s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
s->start_code = SOS;
if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
--
1.7.7.3
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
