From: Luca Barbato <[email protected]>
Currently we are using an array with a static data size.
Similar to a patch with the same purpose by Michael Niedermayer.
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
---
libavcodec/jpeg2kdec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/libavcodec/jpeg2kdec.c b/libavcodec/jpeg2kdec.c
index a6b4a30..3ef864b 100644
--- a/libavcodec/jpeg2kdec.c
+++ b/libavcodec/jpeg2kdec.c
@@ -663,6 +663,12 @@ static int jpeg2k_decode_packet(Jpeg2KDecoderContext *s,
cblk->lblock += llen;
if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0)
return ret;
+ if (ret > sizeof(cblk->data)) {
+ avpriv_request_sample(s->avctx,
+ "Block with lengthinc greater than %zu",
+ sizeof(cblk->data));
+ return AVERROR_PATCHWELCOME;
+ }
cblk->lengthinc = ret;
cblk->npasses += newpasses;
}
--
1.7.9.5
_______________________________________________
libav-devel mailing list
[email protected]
https://lists.libav.org/mailman/listinfo/libav-devel
