diff options
author | Paul B Mahol <onemda@gmail.com> | 2012-07-03 15:56:55 +0400 |
---|---|---|
committer | Paul B Mahol <onemda@gmail.com> | 2012-07-03 17:06:23 +0400 |
commit | 5d171b1f4718ae2916dfddc35299ccdef1e3001c (patch) | |
tree | cadb68feef0b2a643c3ec77d1532d1c766b8e085 /libavcodec | |
parent | f8a81755c2e604febcbf88b5f17d601f30ae0bf9 (diff) |
jvdec: check if there is enough data
Signed-off-by: Paul B Mahol <onemda@gmail.com>
Diffstat (limited to 'libavcodec')
-rw-r--r-- | libavcodec/jvdec.c | 11 |
1 files changed, 6 insertions, 5 deletions
diff --git a/libavcodec/jvdec.c b/libavcodec/jvdec.c index a8c3336ccc..f2a874409c 100644 --- a/libavcodec/jvdec.c +++ b/libavcodec/jvdec.c @@ -137,6 +137,9 @@ static int decode_frame(AVCodecContext *avctx, const uint8_t *buf_end = buf + avpkt->size; int video_size, video_type, i, j; + if (avpkt->size < 6) + return AVERROR_INVALIDDATA; + video_size = AV_RL32(buf); video_type = buf[4]; buf += 5; @@ -162,11 +165,9 @@ static int decode_frame(AVCodecContext *avctx, buf += video_size; } else if (video_type == 2) { - if (buf + 1 <= buf_end) { - int v = *buf++; - for (j = 0; j < avctx->height; j++) - memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width); - } + int v = *buf++; + for (j = 0; j < avctx->height; j++) + memset(s->frame.data[0] + j*s->frame.linesize[0], v, avctx->width); } else { av_log(avctx, AV_LOG_WARNING, "unsupported frame type %i\n", video_type); return AVERROR_INVALIDDATA; |