Skip to content

F
ffmpeg.wasm-core
Commit 282bb028 authored by Michael Niedermayer's avatar Michael Niedermayer
Browse files
Options

j2kdec: Fix crash in get_qcx 

Signed-off-by: 's avatarMichael Niedermayer <michaelni@gmx.at>
parent 3eedf9f7
Show whitespace changes
Inline Side-by-side
Showing with 2 additions and 2 deletions
libavcodec/j2kdec.c
View file @ 282bb028
...@@ -365,7 +365,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q) ...@@ -365,7 +365,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
if (q->quantsty == J2K_QSTY_NONE){ if (q->quantsty == J2K_QSTY_NONE){
n -= 3; n -= 3;
if (s->buf_end - s->buf < n) if (s->buf_end - s->buf < n || 32*3 < n)
return AVERROR(EINVAL); return AVERROR(EINVAL);
for (i = 0; i < n; i++) for (i = 0; i < n; i++)
q->expn[i] = bytestream_get_byte(&s->buf) >> 3; q->expn[i] = bytestream_get_byte(&s->buf) >> 3;
...@@ -382,7 +382,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q) ...@@ -382,7 +382,7 @@ static int get_qcx(J2kDecoderContext *s, int n, J2kQuantStyle *q)
} }
} else{ } else{
n = (n - 3) >> 1; n = (n - 3) >> 1;
if (s->buf_end - s->buf < n) if (s->buf_end - s->buf < n || 32*3 < n)
return AVERROR(EINVAL); return AVERROR(EINVAL);
for (i = 0; i < n; i++){ for (i = 0; i < n; i++){
x = bytestream_get_be16(&s->buf); x = bytestream_get_be16(&s->buf);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment