Patch attached
From 0a28ae573654d05ef56cafbb169674b1829f0c6f Mon Sep 17 00:00:00 2001
From: Paul B Mahol <one...@gmail.com>
Date: Sun, 25 Sep 2022 19:17:25 +0200
Subject: [PATCH] avcodec/mjpegdec: check that index is not negative
Signed-off-by: Paul B Mahol <one...@gmail.com>
---
libavcodec/mjpegdec.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index c594950500..57c7c1c80d 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -374,6 +374,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
for (i = 0; i < nb_components; i++) {
/* component id */
s->component_id[i] = get_bits(&s->gb, 8) - 1;
+ if (s->component_id[i] < 0)
+ return AVERROR_INVALIDDATA;
h_count[i] = get_bits(&s->gb, 4);
v_count[i] = get_bits(&s->gb, 4);
/* compute hmax and vmax (only used in interleaved case) */
@@ -1678,6 +1680,8 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask,
}
for (i = 0; i < nb_components; i++) {
id = get_bits(&s->gb, 8) - 1;
+ if (id < 0)
+ return AVERROR_INVALIDDATA;
av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id);
/* find component index */
for (index = 0; index < s->nb_components; index++)
--
2.37.2
_______________________________________________
ffmpeg-devel mailing list
ffmpeg-devel@ffmpeg.org
https://ffmpeg.org/mailman/listinfo/ffmpeg-devel
To unsubscribe, visit link above, or email
ffmpeg-devel-requ...@ffmpeg.org with subject "unsubscribe".
