On Wed, Jan 25, 2012 at 1:43 PM, Alex Converse <[email protected]> wrote: > In the fate sample field_size is larger than the number of bytes > remaining in the buffer. Furthermore the bytes to bits conversion was > prone to integer overflow when sizing the GetBitContext. > > Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind > --- > libavcodec/mjpegbdec.c | 4 ++-- > 1 files changed, 2 insertions(+), 2 deletions(-) > > diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c > index 4ad17ab..42ece01 100644 > --- a/libavcodec/mjpegbdec.c > +++ b/libavcodec/mjpegbdec.c > @@ -111,8 +111,8 @@ read_header: > av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); > if (sos_offs) > { > -// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8); > - init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8); > + unsigned gb_size = FFMIN(buf_end - buf_ptr - sos_offs, (1<<28) - 1) > * 8; > + init_get_bits(&s->gb, buf_ptr + sos_offs, gb_size); > s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); > s->start_code = SOS; > if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&
Maybe we want to check (buf_end - buf_ptr) at the beginning of each frame? Do we want to try to support very large frames? _______________________________________________ libav-devel mailing list [email protected] https://lists.libav.org/mailman/listinfo/libav-devel
