Merge commit '8aa3500905fec6c4e657bb291b861d43c34d3de9'
authorMichael Niedermayer <michaelni@gmx.at>
Tue, 21 May 2013 08:49:21 +0000 (10:49 +0200)
committerMichael Niedermayer <michaelni@gmx.at>
Tue, 21 May 2013 08:50:03 +0000 (10:50 +0200)
* commit '8aa3500905fec6c4e657bb291b861d43c34d3de9':
  mjpeg: Validate sampling factors

Conflicts:
libavcodec/mjpegdec.c

See: 08c37a10e9ef7e30d7b7a889ad28c7fa9c49c886

Merged-by: Michael Niedermayer <michaelni@gmx.at>
1  2 
libavcodec/mjpegdec.c

@@@ -273,24 -255,25 +273,27 @@@ int ff_mjpeg_decode_sof(MJpegDecodeCont
      for (i = 0; i < nb_components; i++) {
          /* component id */
          s->component_id[i] = get_bits(&s->gb, 8) - 1;
 -        s->h_count[i]      = get_bits(&s->gb, 4);
 -        s->v_count[i]      = get_bits(&s->gb, 4);
 +        h_count[i]         = get_bits(&s->gb, 4);
 +        v_count[i]         = get_bits(&s->gb, 4);
          /* compute hmax and vmax (only used in interleaved case) */
 -        if (s->h_count[i] > s->h_max)
 -            s->h_max = s->h_count[i];
 -        if (s->v_count[i] > s->v_max)
 -            s->v_max = s->v_count[i];
 +        if (h_count[i] > s->h_max)
 +            s->h_max = h_count[i];
 +        if (v_count[i] > s->v_max)
 +            s->v_max = v_count[i];
-         if (!h_count[i] || !v_count[i]) {
-             av_log(s->avctx, AV_LOG_ERROR, "h/v_count is 0\n");
-             return -1;
-         }
          s->quant_index[i] = get_bits(&s->gb, 8);
 -        if (s->quant_index[i] >= 4)
 +        if (s->quant_index[i] >= 4) {
 +            av_log(s->avctx, AV_LOG_ERROR, "quant_index is invalid\n");
              return AVERROR_INVALIDDATA;
 -        if (!s->h_count[i] || !s->v_count[i]) {
 +        }
++        if (!h_count[i] || !v_count[i]) {
+             av_log(s->avctx, AV_LOG_ERROR,
+                    "Invalid sampling factor in component %d %d:%d\n",
 -                   i, s->h_count[i], s->v_count[i]);
++                   i, h_count[i], v_count[i]);
+             return AVERROR_INVALIDDATA;
+         }
          av_log(s->avctx, AV_LOG_DEBUG, "component %d %d:%d id: %d quant:%d\n",
 -               i, s->h_count[i], s->v_count[i],
 +               i, h_count[i], v_count[i],
                 s->component_id[i], s->quant_index[i]);
      }