[FFmpeg-cvslog] jpeg2000dec: Check ncomponents and tile dimensions

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Tue May 21 21:36:32 2013 +0200| [069ede29811685ed7b2cf958471eee455aab2077] | committer: Michael Niedermayer

jpeg2000dec: Check ncomponents and tile dimensions

Fixes various problems

Code ported from j2kdec

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=069ede29811685ed7b2cf958471eee455aab2077
---

 libavcodec/jpeg2000dec.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index f7e6b6e..60489be 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -176,6 +176,13 @@ static int get_siz(Jpeg2000DecoderContext *s)
     s->tile_offset_y  = bytestream_get_be32(&s->buf); // YT0Siz
     s->ncomponents    = bytestream_get_be16(&s->buf); // CSiz
 
+    if(s->ncomponents <= 0 || s->ncomponents > 4) {
+        av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", s->ncomponents);
+        return AVERROR(EINVAL);
+    }
+    if(s->tile_width<=0 || s->tile_height<=0)
+        return AVERROR(EINVAL);
+
     if (s->buf_end - s->buf < 2 * s->ncomponents)
         return AVERROR(EINVAL);