From 129edcb50facad324d80a1e28b6d4be05ce70ab7 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Fri, 14 Jun 2013 00:35:52 +0200
Subject: [PATCH] jpeg2000dec: dont set ncomponents to an invalid value
Fixes out of array accesses
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavcodec/jpeg2000dec.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index da510c66ac7..87a1d58e77c 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -160,6 +160,7 @@ static int tag_tree_decode(Jpeg2000DecoderContext *s, Jpeg2000TgtNode *node,
static int get_siz(Jpeg2000DecoderContext *s)
{
int i;
+ int ncomponents;
if (bytestream2_get_bytes_left(&s->g) < 36)
return AVERROR(EINVAL);
@@ -173,12 +174,14 @@ static int get_siz(Jpeg2000DecoderContext *s)
s->tile_height = bytestream2_get_be32u(&s->g); // YTSiz
s->tile_offset_x = bytestream2_get_be32u(&s->g); // XT0Siz
s->tile_offset_y = bytestream2_get_be32u(&s->g); // YT0Siz
- s->ncomponents = bytestream2_get_be16u(&s->g); // CSiz
+ ncomponents = bytestream2_get_be16u(&s->g); // CSiz
- if (s->ncomponents <= 0 || s->ncomponents > 4) {
- av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", s->ncomponents);
+ if (ncomponents <= 0 || ncomponents > 4) {
+ av_log(s->avctx, AV_LOG_ERROR, "unsupported/invalid ncomponents: %d\n", ncomponents);
return AVERROR(EINVAL);
}
+ s->ncomponents = ncomponents;
+
if (s->tile_width<=0 || s->tile_height<=0)
return AVERROR(EINVAL);
--
GitLab