diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2012-02-13 23:50:35 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2012-03-16 16:46:30 +0100 |
| commit | 001f4c7dc63e90e719187cd7f961c8220721878f (patch) | |
| tree | 690c41d4af0d499347da1db8cf69614d96c1f93d | |
| parent | 313ddbfe48bfd67dc8f9480d7d7cf887d6f485c1 (diff) | |
| download | ffmpeg-001f4c7dc63e90e719187cd7f961c8220721878f.tar.gz | |
jpeglsdec: Prevent out of array write.
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit 00ab9cdae1a96dfea33cd505076a83823f390aa4)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/jpeglsdec.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c index 0139c8860f..74714e0521 100644 --- a/libavcodec/jpeglsdec.c +++ b/libavcodec/jpeglsdec.c @@ -198,6 +198,9 @@ static inline void ls_decode_line(JLSState *state, MJpegDecodeContext *s, void * r = ff_log2_run[state->run_index[comp]]; if(r) r = get_bits_long(&s->gb, r); + if(x + r * stride > w) { + r = (w - x) / stride; + } for(i = 0; i < r; i++) { W(dst, x, Ra); x += stride; |