[FFmpeg-cvslog] mjpeg: Detect overreads in mjpeg_decode_scan() and error out.

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Thu Apr 21 22:03:24 2011 +0200| [76cd98b445c5a1608e9a5974bef0b0be6b35f1ce] | committer: Reinhard Tartler

mjpeg: Detect overreads in mjpeg_decode_scan() and error out.

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
Signed-off-by: Ronald S. Bultje <rbultje at google.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=76cd98b445c5a1608e9a5974bef0b0be6b35f1ce
---

 libavcodec/mjpegdec.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 6f29e46..fa2c505 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -826,6 +826,10 @@ static int mjpeg_decode_scan(MJpegDecodeContext *s, int nb_components, int Ah, i
             if (s->restart_interval && !s->restart_count)
                 s->restart_count = s->restart_interval;
 
+            if(get_bits_count(&s->gb)>s->gb.size_in_bits){
+                av_log(s->avctx, AV_LOG_ERROR, "overread %d\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+                return -1;
+            }
             for(i=0;i<nb_components;i++) {
                 uint8_t *ptr;
                 int n, h, v, x, y, c, j;