diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-21 00:04:19 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-21 00:06:13 +0100 |
| commit | 0c16f6449bb559eca2982c96e79eb7cee7abbfd8 (patch) | |
| tree | ebbcd9ffb7e2d730457ea3aeb4ddf593be71d026 /libavformat/jvdec.c | |
| parent | b9f33ad32077eb0570a9038a9ff93a176ef66dfe (diff) | |
| parent | 15739a9bd19a7d47ad8afb25348c684a3bdd6ef2 (diff) | |
| download | ffmpeg-0c16f6449bb559eca2982c96e79eb7cee7abbfd8.tar.gz | |
Merge commit '15739a9bd19a7d47ad8afb25348c684a3bdd6ef2'
* commit '15739a9bd19a7d47ad8afb25348c684a3bdd6ef2':
jvdec: Do not feed the decoder with known wrong data
Merged-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/jvdec.c')
| -rw-r--r-- | libavformat/jvdec.c | 17 |
1 files changed, 15 insertions, 2 deletions
diff --git a/libavformat/jvdec.c b/libavformat/jvdec.c index 548223116f..03ac43d10e 100644 --- a/libavformat/jvdec.c +++ b/libavformat/jvdec.c @@ -128,10 +128,23 @@ static int read_header(AVFormatContext *s) jvf->audio_size = avio_rl32(pb); jvf->video_size = avio_rl32(pb); jvf->palette_size = avio_r8(pb) ? 768 : 0; - jvf->video_size = FFMIN(FFMAX(jvf->video_size, 0), - INT_MAX - JV_PREAMBLE_SIZE - jvf->palette_size); + + if ((jvf->video_size | jvf->audio_size) & ~0xFFFFFF || + e->size - jvf->audio_size + - jvf->video_size + - jvf->palette_size < 0) { + if (s->error_recognition & AV_EF_EXPLODE) { + read_close(s); + return AVERROR_INVALIDDATA; + } + jvf->audio_size = + jvf->video_size = + jvf->palette_size = 0; + } + if (avio_r8(pb)) av_log(s, AV_LOG_WARNING, "unsupported audio codec\n"); + jvf->video_type = avio_r8(pb); avio_skip(pb, 1); |