jpeg2000: Validate resolution levels
authorLuca Barbato <lu_zero@gentoo.org>
Mon, 1 Jul 2013 08:00:58 +0000 (10:00 +0200)
committerLuca Barbato <lu_zero@gentoo.org>
Tue, 2 Jul 2013 18:05:43 +0000 (20:05 +0200)
There are 32 maximum decomposition levels, thus 33 resolution levels.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
libavcodec/jpeg2000dec.c

index 8c49ea9..e29f731 100644 (file)
@@ -251,7 +251,12 @@ static int get_cox(Jpeg2000DecoderContext *s, Jpeg2000CodingStyle *c)
 
     if (s->buf_end - s->buf < 5)
         return AVERROR(EINVAL);
-    c->nreslevels = bytestream_get_byte(&s->buf) + 1; // num of resolution levels - 1
+    /*  nreslevels = number of resolution levels
+                   = number of decomposition level +1 */
+    c->nreslevels = bytestream_get_byte(&s->buf) + 1;
+
+    if (c->nreslevels > JPEG2000_MAX_RESLEVELS)
+        return AVERROR_INVALIDDATA;
 
     /* compute number of resolution levels to decode */
     if (c->nreslevels < s->reduction_factor)