mjpegbdec: Fix incorrect bitstream buffer size.

Fixes CVE-2011-3947

Michael Niedermayer committed 14 years ago

Commit 01e5e971 parent dd453f11 file · +1 −2Browse files

Unified · Split

@@ -111,8 +111,7 @@ read_header: · 110 unmodified lines
111	111	av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
112	112	if (sos_offs)
113	113	{
114		−// init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8);
115		− init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8);
	114	+ init_get_bits(&s->gb, buf_ptr+sos_offs, FFMIN(field_size, buf_end - (buf_ptr+sos_offs))*8);
116	115	s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16));
117	116	s->start_code = SOS;
118	117	if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 &&

Keyboard shortcuts