commit eed5697f99927c78956fde6ee6f1ac87f3c6d261
author Michael Niedermayer <michaelni@gmx.at> Thu Apr 21 22:03:24 2011 +0200
committer Reinhard Tartler <siretart@tauware.de> Tue Apr 26 09:40:06 2011 +0200
tree 5f891b0b622c0fa4adc20402366bca9ec873d288
parent 52ee20f2aa2936e0fb0a90e81c39135a8f2394e9

mjpeg: Detect overreads in mjpeg_decode_scan() and error out.

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Signed-off-by: Ronald S. Bultje <rbultje@google.com>
Signed-off-by: Reinhard Tartler <siretart@tauware.de>

libavcodec/mjpegdec.c

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 145719c..e5c9f38 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -784,6 +784,10 @@
             if (s->restart_interval && !s->restart_count)
                 s->restart_count = s->restart_interval;
 
+            if(get_bits_count(&s->gb)>s->gb.size_in_bits){
+                av_log(s->avctx, AV_LOG_ERROR, "overread %d\n", get_bits_count(&s->gb) - s->gb.size_in_bits);
+                return -1;
+            }
             for(i=0;i<nb_components;i++) {
                 uint8_t *ptr;
                 int n, h, v, x, y, c, j;