[FFmpeg-cvslog] jpeg2000: Check block length

[Luca Barbato]

ffmpeg | branch: master | Luca Barbato <lu_zero at gentoo.org> | Wed Oct  9 06:17:12 2013 +0200| [1018a92219a38a812cf97761c6b3a5e66a400f4b] | committer: Luca Barbato

jpeg2000: Check block length

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable at libav.org

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=1018a92219a38a812cf97761c6b3a5e66a400f4b
---

 libavcodec/jpeg2000dec.c |    7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 18346f9..cc154c3 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -715,6 +715,13 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s,
             }
             cblk->length   += cblk->lengthinc;
             cblk->lengthinc = 0;
+
+            if (cblk->length > sizeof(cblk->data)) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "Block length %d > data size %zd\n",
+                       cblk->length, sizeof(cblk->data));
+                return AVERROR_INVALIDDATA;
+            }
         }
     }
     return 0;