[FFmpeg-cvslog] avcodec/mjpegdec: check bits per pixel for changes similar to dimensions
Michael Niedermayer
git at videolan.org
Sun Dec 21 04:50:27 CET 2014
ffmpeg | branch: release/1.1 | Michael Niedermayer <michaelni at gmx.at> | Fri Oct 3 01:50:27 2014 +0200| [29abba35723ad6ce481dfe277dad6d0575f2dbb6] | committer: Michael Niedermayer
avcodec/mjpegdec: check bits per pixel for changes similar to dimensions
Fixes out of array accesses
Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni at gmx.at>
(cherry picked from commit 5c378d6a6df8243f06c87962b873bd563e58cd39)
Conflicts:
libavcodec/mjpegdec.c
(cherry picked from commit 94371a404c663c3dae3d542fa43951567ab67f82)
Conflicts:
libavcodec/mjpegdec.c
> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=29abba35723ad6ce481dfe277dad6d0575f2dbb6
---
libavcodec/mjpegdec.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 1608b4f..9a69bed 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -211,7 +211,7 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s)
int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
{
- int len, nb_components, i, width, height, pix_fmt_id;
+ int len, nb_components, i, width, height, bits, pix_fmt_id;
int h_count[MAX_COMPONENTS];
int v_count[MAX_COMPONENTS];
@@ -220,14 +220,14 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* XXX: verify len field validity */
len = get_bits(&s->gb, 16);
- s->bits = get_bits(&s->gb, 8);
+ bits = get_bits(&s->gb, 8);
if (s->pegasus_rct)
- s->bits = 9;
- if (s->bits == 9 && !s->pegasus_rct)
+ bits = 9;
+ if (bits == 9 && !s->pegasus_rct)
s->rct = 1; // FIXME ugly
- if (s->bits != 8 && !s->lossless) {
+ if (bits != 8 && !s->lossless) {
av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n");
return -1;
}
@@ -259,7 +259,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
return AVERROR_INVALIDDATA;
}
}
- if (s->ls && !(s->bits <= 8 || nb_components == 1)) {
+ if (s->ls && !(bits <= 8 || nb_components == 1)) {
av_log_missing_feature(s->avctx,
"For JPEG-LS anything except <= 8 bits/component"
" or 16-bit gray", 0);
@@ -307,12 +307,14 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
/* if different size, realloc/alloc picture */
if ( width != s->width || height != s->height
+ || bits != s->bits
|| memcmp(s->h_count, h_count, sizeof(h_count[0])*nb_components)
|| memcmp(s->v_count, v_count, sizeof(v_count[0])*nb_components)) {
av_freep(&s->qscale_table);
s->width = width;
s->height = height;
+ s->bits = bits;
memcpy(s->h_count, h_count, sizeof(h_count));
memcpy(s->v_count, v_count, sizeof(v_count));
s->interlaced = 0;
More information about the ffmpeg-cvslog
mailing list