lavc/mjpegdec: Do not overread too short JFIF tags.

Fixes ticket #6055.

lavc/mjpegdec: Do not overread too short JFIF tags.
Fixes ticket #6055.
4acea512 · Carl Eugen Hoyos · b7a6d28e · 4acea512
Commit 4acea512 authored Jan 01, 2017 by Carl Eugen Hoyos
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 0 deletions

mjpegdec.c libavcodec/mjpegdec.c +2 -0

No files found.
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1670,6 +1670,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)

    if (id == AV_RB32("JFIF")) {
        int t_w, t_h, v1, v2;
+        if (len < 8)
+            goto out;
        skip_bits(&s->gb, 8); /* the trailing zero-byte */
        v1 = get_bits(&s->gb, 8);
        v2 = get_bits(&s->gb, 8);