mjpegdec: Fix out of array read in unescaping code
authorMichael Niedermayer <michaelni@gmx.at>
Fri, 11 Jan 2013 17:19:53 +0000 (18:19 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Fri, 11 Jan 2013 17:20:25 +0000 (18:20 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mjpegdec.c

index 78af858..78a0453 100644 (file)
@@ -1590,7 +1590,7 @@ int ff_mjpeg_find_marker(MJpegDecodeContext *s,
                 while ((src + t < buf_end) && x == 0xff)
                     x = src[t++];
                 if (x & 0x80) {
-                    t -= 2;
+                    t -= FFMIN(2, t);
                     break;
                 }
             }