[FFmpeg-cvslog] jvdec: check if there is enough data

[Paul B Mahol]

ffmpeg | branch: master | Paul B Mahol <onemda at gmail.com> | Tue Jul  3 11:56:55 2012 +0000| [5d171b1f4718ae2916dfddc35299ccdef1e3001c] | committer: Paul B Mahol

jvdec: check if there is enough data

Signed-off-by: Paul B Mahol <onemda at gmail.com>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=5d171b1f4718ae2916dfddc35299ccdef1e3001c
---

 libavcodec/jvdec.c |   11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/libavcodec/jvdec.c b/libavcodec/jvdec.c
index a8c3336..f2a8744 100644
--- a/libavcodec/jvdec.c
+++ b/libavcodec/jvdec.c
@@ -137,6 +137,9 @@ static int decode_frame(AVCodecContext *avctx,
     const uint8_t *buf_end = buf + avpkt->size;
     int video_size, video_type, i, j;
 
+    if (avpkt->size < 6)
+        return AVERROR_INVALIDDATA;
+
     video_size = AV_RL32(buf);
     video_type = buf[4];
     buf += 5;
@@ -162,11 +165,9 @@ static int decode_frame(AVCodecContext *avctx,
 
             buf += video_size;
         } else if (video_type == 2) {
-            if (buf + 1 <= buf_end) {
-                int v = *buf++;
-                for (j = 0; j < avctx->height; j++)
-                    memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width);
-            }
+            int v = *buf++;
+            for (j = 0; j < avctx->height; j++)
+                memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width);
         } else {
             av_log(avctx, AV_LOG_WARNING, "unsupported frame type %i\n", video_type);
             return AVERROR_INVALIDDATA;