summaryrefslogtreecommitdiff
path: root/libavformat/rtpdec_jpeg.c
diff options
context:
space:
mode:
authorMartin Storsjö <martin@martin.st>2012-09-11 14:41:42 +0300
committerMartin Storsjö <martin@martin.st>2012-09-12 12:10:45 +0300
commit1743938df10dd888484f964d5af8fd3957d26809 (patch)
tree7222cf564d73d294f315088aa4f769f9d1f6c69b /libavformat/rtpdec_jpeg.c
parent1de9317bd08d71b6b988a8a64de18f4c2f98e031 (diff)
downloadffmpeg-1743938df10dd888484f964d5af8fd3957d26809.tar.gz
rtpdec_jpeg: Disallow using the reserved q values
Signed-off-by: Martin Storsjö <martin@martin.st>
Diffstat (limited to 'libavformat/rtpdec_jpeg.c')
-rw-r--r--libavformat/rtpdec_jpeg.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/libavformat/rtpdec_jpeg.c b/libavformat/rtpdec_jpeg.c
index 3f47e71bd3..3f53887798 100644
--- a/libavformat/rtpdec_jpeg.c
+++ b/libavformat/rtpdec_jpeg.c
@@ -304,6 +304,10 @@ static int jpeg_parse_packet(AVFormatContext *ctx, PayloadContext *jpeg,
qtable_len = jpeg->qtables_len[q - 128];
}
} else { /* q <= 127 */
+ if (q == 0 || q > 99) {
+ av_log(ctx, AV_LOG_ERROR, "Reserved q value %d\n", q);
+ return AVERROR_INVALIDDATA;
+ }
create_default_qtables(new_qtables, q);
qtables = new_qtables;
qtable_len = sizeof(new_qtables);