mirrors/librempeg
1
0
Fork 0
mirror of https://github.com/librempeg/librempeg synced 2024-11-22 18:49:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge commit '15739a9bd19a7d47ad8afb25348c684a3bdd6ef2'

Browse Source 
* commit '15739a9bd19a7d47ad8afb25348c684a3bdd6ef2':
  jvdec: Do not feed the decoder with known wrong data

Merged-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-12-21 00:04:19 +01:00
commit 0c16f6449b
1 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
libavformat/jvdec.c
View File

@ -128,10 +128,23 @@ static int read_header(AVFormatContext *s)
jvf->audio_size = avio_rl32(pb);
jvf->video_size = avio_rl32(pb);
jvf->palette_size = avio_r8(pb) ? 768 : 0;
jvf->video_size = FFMIN(FFMAX(jvf->video_size, 0),
INT_MAX - JV_PREAMBLE_SIZE - jvf->palette_size);
if ((jvf->video_size | jvf->audio_size) & ~0xFFFFFF ||
e->size - jvf->audio_size
- jvf->video_size
- jvf->palette_size < 0) {
if (s->error_recognition & AV_EF_EXPLODE) {
read_close(s);
return AVERROR_INVALIDDATA;
}
jvf->audio_size =
jvf->video_size =
jvf->palette_size = 0;
}
if (avio_r8(pb))
av_log(s, AV_LOG_WARNING, "unsupported audio codec\n");
jvf->video_type = avio_r8(pb);
avio_skip(pb, 1);