diff options
author | Michael Niedermayer <michaelni@gmx.at> | 2012-04-22 16:19:18 +0400 |
---|---|---|
committer | Michael Niedermayer <michaelni@gmx.at> | 2012-04-22 16:58:28 +0400 |
commit | 9a4f5b76169a71156819dbaa8ee0b6ea25dc7195 (patch) | |
tree | 5487924372ca81a942e72689b1d50ad825568e3c /libavcodec/mjpegdec.c | |
parent | abec6549ae1e86fdf89dbab8a8abca8eb7205c6e (diff) |
mjpegbdec: check SOS/SOF ordering.
Fixes null ptr dereference
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavcodec/mjpegdec.c')
-rw-r--r-- | libavcodec/mjpegdec.c | 12 |
1 files changed, 7 insertions, 5 deletions
diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index c3e69f69e1..c9021b9e7a 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1148,6 +1148,13 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask, const int block_size = s->lossless ? 1 : 8; int ilv, prev_shift; + if (!s->got_picture) { + av_log(s->avctx, AV_LOG_WARNING, + "Can not process SOS before SOF, skipping\n"); + return -1; + } + + av_assert0(s->picture_ptr->data[0]); /* XXX: verify len field validity */ len = get_bits(&s->gb, 16); nb_components = get_bits(&s->gb, 8); @@ -1699,11 +1706,6 @@ eoi_parser: goto the_end; case SOS: - if (!s->got_picture) { - av_log(avctx, AV_LOG_WARNING, - "Can not process SOS before SOF, skipping\n"); - break; - } if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && (avctx->err_recognition & AV_EF_EXPLODE)) return AVERROR_INVALIDDATA; |