diff options
| author | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2015-07-09 20:03:38 +0200 |
|---|---|---|
| committer | Carl Eugen Hoyos <cehoyos@ag.or.at> | 2015-07-09 20:03:38 +0200 |
| commit | e786e96be70adb084f0dc672900302c577a347cf (patch) | |
| tree | 9a508633bcdf54d05101349482b0ddfbbe66a9f1 /libavformat/rtpenc_jpeg.c | |
| parent | ad7c5cba4ee9644a580d8f4a5abd1feda690b1ef (diff) | |
| download | ffmpeg-e786e96be70adb084f0dc672900302c577a347cf.tar.gz | |
lavf/rtpenc_jpeg: Error out for non-standard Huffman tables.
Related to ticket #3823.
Diffstat (limited to 'libavformat/rtpenc_jpeg.c')
| -rw-r--r-- | libavformat/rtpenc_jpeg.c | 20 |
1 files changed, 20 insertions, 0 deletions
diff --git a/libavformat/rtpenc_jpeg.c b/libavformat/rtpenc_jpeg.c index e05e9b5438..13d61a97aa 100644 --- a/libavformat/rtpenc_jpeg.c +++ b/libavformat/rtpenc_jpeg.c @@ -21,6 +21,7 @@ #include "libavcodec/bytestream.h" #include "libavcodec/mjpeg.h" +#include "libavcodec/jpegtables.h" #include "libavutil/intreadwrite.h" #include "rtpenc.h" @@ -81,6 +82,25 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size) "Only 1x1 chroma blocks are supported. Aborted!\n"); return; } + } else if (buf[i + 1] == DHT) { + if ( AV_RB16(&buf[i + 2]) < 418 + || i + 420 >= size + || buf[i + 4] != 0x00 + || buf[i + 33] != 0x01 + || buf[i + 62] != 0x10 + || buf[i + 241] != 0x11 + || memcmp(buf + i + 5, avpriv_mjpeg_bits_dc_luminance + 1, 16) + || memcmp(buf + i + 21, avpriv_mjpeg_val_dc, 12) + || memcmp(buf + i + 34, avpriv_mjpeg_bits_dc_chrominance + 1, 16) + || memcmp(buf + i + 50, avpriv_mjpeg_val_dc, 12) + || memcmp(buf + i + 63, avpriv_mjpeg_bits_ac_luminance + 1, 16) + || memcmp(buf + i + 79, avpriv_mjpeg_val_ac_luminance, 162) + || memcmp(buf + i + 242, avpriv_mjpeg_bits_ac_chrominance + 1, 16) + || memcmp(buf + i + 258, avpriv_mjpeg_val_ac_chrominance, 162)) { + av_log(s1, AV_LOG_ERROR, + "RFC 2435 requires standard Huffman tables for jpeg\n"); + return; + } } else if (buf[i + 1] == SOS) { /* SOS is last marker in the header */ i += AV_RB16(&buf[i + 2]) + 2; |