jvdec: check that the video_size fits in the packet.
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Jul 2012 10:32:26 +0000 (12:32 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 3 Jul 2012 10:38:03 +0000 (12:38 +0200)
Prevents use of out of array data and fate failure.

Found-by: durandal_1707
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/jvdec.c
tests/ref/fate/jv

index 4031fad..728b749 100644 (file)
@@ -143,7 +143,7 @@ static int decode_frame(AVCodecContext *avctx,
     buf += 5;
 
     if (video_size) {
-        if(video_size < 0) {
+        if(video_size < 0 || video_size > buf_size) {
             av_log(avctx, AV_LOG_ERROR, "video size %d invalid\n", video_size);
             return AVERROR_INVALIDDATA;
         }
index 88b345c..b0a6008 100644 (file)
@@ -6,4 +6,3 @@
 0,          5,          5,        1,   192000, 0xb8e331eb
 0,          6,          6,        1,   192000, 0xd35b2053
 0,          7,          7,        1,   192000, 0x01062188
-0,          8,          8,        1,   192000, 0xa3a73b87