git.videolan.org
/
ffmpeg.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(parent:
abe6836
)
mjpegdec: tighten unescaped_buf_size size check, prevent null ptr deref
author
Michael Niedermayer
<michaelni@gmx.at>
Mon, 12 Nov 2012 19:27:29 +0000
(20:27 +0100)
committer
Michael Niedermayer
<michaelni@gmx.at>
Mon, 12 Nov 2012 19:27:57 +0000
(20:27 +0100)
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavcodec/mjpegdec.c
patch
|
blob
|
history
diff --git
a/libavcodec/mjpegdec.c
b/libavcodec/mjpegdec.c
index
0a71a6f
..
ae0e504
100644
(file)
--- a/
libavcodec/mjpegdec.c
+++ b/
libavcodec/mjpegdec.c
@@
-1611,7
+1611,7
@@
int ff_mjpeg_decode_frame(AVCodecContext *avctx, void *data, int *data_size,
/* EOF */
if (start_code < 0) {
goto the_end;
- } else if (unescaped_buf_size > (1U<<2
9
)) {
+ } else if (unescaped_buf_size > (1U<<2
8
)) {
av_log(avctx, AV_LOG_ERROR, "MJPEG packet 0x%x too big (0x%x/0x%x), corrupt data?\n",
start_code, unescaped_buf_size, buf_size);
return AVERROR_INVALIDDATA;