Commit cfbd98ab authored by Luca Barbato's avatar Luca Barbato

mjpegdec: validate parameters in mjpeg_decode_scan_progressive_ac

Prevent out of buffer write when decoding broken samples.

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
parent c209d0df
...@@ -941,6 +941,11 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss, ...@@ -941,6 +941,11 @@ static int mjpeg_decode_scan_progressive_ac(MJpegDecodeContext *s, int ss,
int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]]; int16_t *quant_matrix = s->quant_matrixes[s->quant_index[c]];
GetBitContext mb_bitmask_gb; GetBitContext mb_bitmask_gb;
if (ss < 0 || ss >= 64 ||
se < ss || se >= 64 ||
Ah < 0 || Al < 0)
return AVERROR_INVALIDDATA;
if (mb_bitmask) if (mb_bitmask)
init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height); init_get_bits(&mb_bitmask_gb, mb_bitmask, s->mb_width * s->mb_height);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment