Commit dce778e0 authored by Zdenek Kabelac's avatar Zdenek Kabelac
Browse files

* check for potentialy problematic field len

Originally committed as revision 1572 to svn://svn.ffmpeg.org/ffmpeg/trunk
parent b29f97d1
...@@ -1262,31 +1262,33 @@ out: ...@@ -1262,31 +1262,33 @@ out:
static int mjpeg_decode_com(MJpegDecodeContext *s) static int mjpeg_decode_com(MJpegDecodeContext *s)
{ {
int i;
UINT8 *cbuf;
/* XXX: verify len field validity */ /* XXX: verify len field validity */
unsigned int len = get_bits(&s->gb, 16)-2; unsigned int len = get_bits(&s->gb, 16);
cbuf = av_malloc(len+1); if (len >= 2 && len < 32768) {
/* XXX: any better upper bound */
for (i = 0; i < len; i++) UINT8 *cbuf = av_malloc(len - 1);
cbuf[i] = get_bits(&s->gb, 8); if (cbuf) {
if (cbuf[i-1] == '\n') int i;
cbuf[i-1] = 0; for (i = 0; i < len - 2; i++)
else cbuf[i] = get_bits(&s->gb, 8);
cbuf[i] = 0; if (i > 0 && cbuf[i-1] == '\n')
cbuf[i-1] = 0;
printf("mjpeg comment: '%s'\n", cbuf); else
cbuf[i] = 0;
printf("mjpeg comment: '%s'\n", cbuf);
/* buggy avid, it puts EOI only at every 10th frame */
if (!strcmp(cbuf, "AVID"))
{
s->buggy_avid = 1;
// if (s->first_picture)
// printf("mjpeg: workarounding buggy AVID\n");
}
/* buggy avid, it puts EOI only at every 10th frame */ av_free(cbuf);
if (!strcmp(cbuf, "AVID")) }
{
s->buggy_avid = 1;
// if (s->first_picture)
// printf("mjpeg: workarounding buggy AVID\n");
} }
av_free(cbuf);
return 0; return 0;
} }
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment