From: Michael Niedermayer <michaelni@gmx.at>
Date: Mon, 1 Jul 2013 08:01:06 +0000 (+0200)
Subject: jpeg2000: Check zero bit-plane validity
X-Git-Tag: android-x86-4.4-r1~364^2~780
X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=17e5d614a8647d51b9795cb8bccf97ee33ca2d58;p=android-x86%2Fexternal-ffmpeg.git

jpeg2000: Check zero bit-plane validity

Prevent integer overflows.

Signed-off-by: Luca Barbato <lu_zero@gentoo.org>
---

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 83efab8bc4..ffe97eb59b 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -652,10 +652,16 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s,
             else if (incl < 0)
                 return incl;
 
-            if (!cblk->npasses)
-                cblk->nonzerobits = expn[bandno] + numgbits - 1 -
-                                    tag_tree_decode(s, prec->zerobits + cblkno,
-                                                    100);
+            if (!cblk->npasses) {
+                int v = expn[bandno] + numgbits - 1 -
+                        tag_tree_decode(s, prec->zerobits + cblkno, 100);
+                if (v < 0) {
+                    av_log(s->avctx, AV_LOG_ERROR,
+                           "nonzerobits %d invalid\n", v);
+                    return AVERROR_INVALIDDATA;
+                }
+                cblk->nonzerobits = v;
+            }
             if ((newpasses = getnpasses(s)) < 0)
                 return newpasses;
             if ((llen = getlblockinc(s)) < 0)