Patrick Williams | b48b7b4 | 2016-08-17 15:04:38 -0500 | [diff] [blame^] | 1 | From 6043c431c97d55173f339fafbd033d3c0642e2e9 Mon Sep 17 00:00:00 2001 |
| 2 | From: Michael Niedermayer <michaelni@gmx.at> |
| 3 | Date: Fri, 3 Oct 2014 01:50:27 +0200 |
| 4 | Subject: [PATCH 2/2] avcodec/mjpegdec: check bits per pixel for changes |
| 5 | similar to dimensions |
| 6 | |
| 7 | Upstream-Status: Backport |
| 8 | |
| 9 | Fixes out of array accesses |
| 10 | Fixes: asan_heap-oob_16668e9_2_asan_heap-oob_16668e9_346_miss_congeniality_pegasus_mjpg.avi |
| 11 | |
| 12 | Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind |
| 13 | Signed-off-by: Michael Niedermayer <michaelni@gmx.at> |
| 14 | |
| 15 | Conflicts: |
| 16 | libavcodec/mjpegdec.c |
| 17 | --- |
| 18 | libavcodec/mjpegdec.c | 15 ++++++++------- |
| 19 | 1 file changed, 8 insertions(+), 7 deletions(-) |
| 20 | |
| 21 | diff --git a/gst-libs/ext/libav/libavcodec/mjpegdec.c b/gst-libs/ext/libav/libavcodec/mjpegdec.c |
| 22 | index 84343c0..c0137d8 100644 |
| 23 | --- a/gst-libs/ext/libav/libavcodec/mjpegdec.c |
| 24 | +++ b/gst-libs/ext/libav/libavcodec/mjpegdec.c |
| 25 | @@ -210,16 +210,16 @@ int ff_mjpeg_decode_dht(MJpegDecodeContext *s) |
| 26 | |
| 27 | int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
| 28 | { |
| 29 | - int len, nb_components, i, width, height, pix_fmt_id; |
| 30 | + int len, nb_components, i, bits, width, height, pix_fmt_id; |
| 31 | |
| 32 | /* XXX: verify len field validity */ |
| 33 | len = get_bits(&s->gb, 16); |
| 34 | - s->bits= get_bits(&s->gb, 8); |
| 35 | + bits= get_bits(&s->gb, 8); |
| 36 | |
| 37 | - if(s->pegasus_rct) s->bits=9; |
| 38 | - if(s->bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly |
| 39 | + if(s->pegasus_rct) bits=9; |
| 40 | + if(bits==9 && !s->pegasus_rct) s->rct=1; //FIXME ugly |
| 41 | |
| 42 | - if (s->bits != 8 && !s->lossless){ |
| 43 | + if (bits != 8 && !s->lossless){ |
| 44 | av_log(s->avctx, AV_LOG_ERROR, "only 8 bits/component accepted\n"); |
| 45 | return -1; |
| 46 | } |
| 47 | @@ -239,7 +239,7 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
| 48 | if (nb_components <= 0 || |
| 49 | nb_components > MAX_COMPONENTS) |
| 50 | return -1; |
| 51 | - if (s->ls && !(s->bits <= 8 || nb_components == 1)){ |
| 52 | + if (s->ls && !(bits <= 8 || nb_components == 1)){ |
| 53 | av_log(s->avctx, AV_LOG_ERROR, "only <= 8 bits/component or 16-bit gray accepted for JPEG-LS\n"); |
| 54 | return -1; |
| 55 | } |
| 56 | @@ -272,10 +272,11 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) |
| 57 | |
| 58 | /* if different size, realloc/alloc picture */ |
| 59 | /* XXX: also check h_count and v_count */ |
| 60 | - if (width != s->width || height != s->height) { |
| 61 | + if (width != s->width || height != s->height || bits != s->bits) { |
| 62 | av_freep(&s->qscale_table); |
| 63 | |
| 64 | s->width = width; |
| 65 | + s->bits= bits; |
| 66 | s->height = height; |
| 67 | s->interlaced = 0; |
| 68 | |