avcodec/mjpegdec: Add some sanity checks to ljpeg_decode_rgb_scan()
authorMichael Niedermayer <michaelni@gmx.at>
Wed, 4 Sep 2013 22:36:44 +0000 (00:36 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Wed, 4 Sep 2013 23:39:20 +0000 (01:39 +0200)
These prevent the rgb ljpeg code from being run on parameters that it doesnt
support. No testcase available but it seems possible to trigger these.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mjpegdec.c

index c89bfdb..2d609c4 100644 (file)
@@ -794,6 +794,12 @@ static int ljpeg_decode_rgb_scan(MJpegDecodeContext *s, int nb_components, int p
     int resync_mb_y = 0;
     int resync_mb_x = 0;
 
+    if (s->nb_components != 3 && s->nb_components != 4)
+        return AVERROR_INVALIDDATA;
+    if (s->v_max != 1 || s->h_max != 1 || !s->lossless)
+        return AVERROR_INVALIDDATA;
+
+
     s->restart_count = s->restart_interval;
 
     av_fast_malloc(&s->ljpeg_buffer, &s->ljpeg_buffer_size,