Fixes CVE-2011-3947
Unified · Split
| @@ -111,8 +111,7 @@ read_header: · 110 unmodified lines | |||
| 111 | av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); | 111 | av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs); |
| 112 | if (sos_offs) | 112 | if (sos_offs) |
| 113 | { | 113 | { |
| 114 | // init_get_bits(&s->gb, buf+sos_offs, (buf_end - (buf+sos_offs))*8); | 114 | init_get_bits(&s->gb, buf_ptr+sos_offs, FFMIN(field_size, buf_end - (buf_ptr+sos_offs))*8); |
| 115 | init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8); | ||
| 116 | s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); | 115 | s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); |
| 117 | s->start_code = SOS; | 116 | s->start_code = SOS; |
| 118 | if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && | 117 | if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && |