Le 24/06/2013 17:14, Luca Barbato a écrit :
Currently we are using an array with a static data size.
Similar to a patch with the same purpose by Michael Niedermayer.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
---
libavcodec/jpeg2kdec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/jpeg2kdec.c b/libavcodec/jpeg2kdec.c
index c8bc322..3b99d4e 100644
--- a/libavcodec/jpeg2kdec.c
+++ b/libavcodec/jpeg2kdec.c
@@ -662,6 +662,12 @@ static int jpeg2k_decode_packet(Jpeg2KDecoderContext *s,
cblk->lblock += llen;
if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0)
return ret;
+ if (ret > sizeof(cblk->data)) {
+ avpriv_request_sample(s->avctx,
+ "Block with lengthinc greater than %zu",
+ sizeof(cblk->data));
+ return AVERROR_PATCHWELCOME;
+ }
I think an error should be raised in that case.
Or In the reverse allow memory for cblk->data ( who is 8192, and quite
huge) according lenghtinc
cblk->lengthinc = ret;
cblk->npasses += newpasses;
}
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
