lavc/mjpegdec: Do not overread too short JFIF tags.
authorCarl Eugen Hoyos <cehoyos@ag.or.at>
Sun, 1 Jan 2017 13:19:48 +0000 (14:19 +0100)
committerCarl Eugen Hoyos <cehoyos@ag.or.at>
Sun, 1 Jan 2017 17:53:27 +0000 (18:53 +0100)
Fixes ticket #6055.

libavcodec/mjpegdec.c

index eee8d58..e0b22ec 100644 (file)
@@ -1670,6 +1670,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
 
     if (id == AV_RB32("JFIF")) {
         int t_w, t_h, v1, v2;
+        if (len < 8)
+            goto out;
         skip_bits(&s->gb, 8); /* the trailing zero-byte */
         v1 = get_bits(&s->gb, 8);
         v2 = get_bits(&s->gb, 8);