[libav-devel] [PATCH 3/3] mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

[Luca Barbato]

Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-sta...@libav.org
---
 libavcodec/mjpegdec.c | 5 +++++
 libavcodec/mjpegdec.h | 7 ++++---
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 896fa99..7a1075d 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -941,6 +941,11 @@ static int 
mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
     int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
     GetBitContext mb_bitmask_gb;
 
+    if (ss < 0  || ss >= DCTSIZE2 ||
+        se < se || se >= DCTSIZE2 ||
+        Ah < 0  || Al < 0)
+        return AVERROR_INVALIDDATA;
+
     if (mb_bitmask)
         init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);
 
diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h
index 36598dd..f108bd9 100644
--- a/libavcodec/mjpegdec.h
+++ b/libavcodec/mjpegdec.h
@@ -37,6 +37,7 @@
 #include "hpeldsp.h"
 
 #define MAX_COMPONENTS 4
+#define DCTSIZE2 64
 
 typedef struct MJpegDecodeContext {
     AVClass *class;
@@ -47,7 +48,7 @@ typedef struct MJpegDecodeContext {
     int buffer_size;
     uint8_t *buffer;
 
-    int16_t quant_matrixes[4][64];
+    int16_t quant_matrixes[4][DCTSIZE2];
     VLC vlcs[3][4];
     int qscale[4];      ///< quantizer scale calculated from quant_matrixes
 
@@ -89,8 +90,8 @@ typedef struct MJpegDecodeContext {
     int got_picture;                                ///< we found a SOF and 
picture is valid, too.
     int linesize[MAX_COMPONENTS];                   ///< linesize << interlaced
     int8_t *qscale_table;
-    DECLARE_ALIGNED(16, int16_t, block)[64];
-    int16_t (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive 
mode)
+    DECLARE_ALIGNED(16, int16_t, block)[DCTSIZE2];
+    int16_t (*blocks[MAX_COMPONENTS])[DCTSIZE2]; ///< intermediate sums 
(progressive mode)
     uint8_t *last_nnz[MAX_COMPONENTS];
     uint64_t coefs_finished[MAX_COMPONENTS]; ///< bitmask of which coefs have 
been completely decoded (progressive mode)
     ScanTable scantable;
-- 
1.8.2.1

_______________________________________________
libav-devel mailing list
libav-devel@libav.org
https://lists.libav.org/mailman/listinfo/libav-devel