From 021dccba1ff01b9005199fe8671a1887a262b430 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 25 Jan 2010 13:26:10 +0000 Subject: [PATCH] Fix heap overflow due to lack of nb_components check. Originally committed as revision 21450 to svn://svn.ffmpeg.org/ffmpeg/trunk --- libavcodec/mjpegdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index 86862dbd4..dc8df55d4 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -899,6 +899,10 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s) /* XXX: verify len field validity */ len = get_bits(&s->gb, 16); nb_components = get_bits(&s->gb, 8); + if (nb_components == 0 || nb_components > MAX_COMPONENTS){ + av_log(s->avctx, AV_LOG_ERROR, "decode_sos: nb_components (%d) unsupported\n", nb_components); + return -1; + } if (len != 6+2*nb_components) { av_log(s->avctx, AV_LOG_ERROR, "decode_sos: invalid len (%d)\n", len); -- 2.11.0