[SCM] libav/experimental: Make sure offsets of mjpeg b are within the buffer. Fixes issue1132

[siretart at users.alioth.debian.org]

The following commit has been merged in the experimental branch:
commit ff8c65f482d9daea458ab2f419db4b841d718c5c
Author: Michael Niedermayer <michaelni at gmx.at>
Date:   Sat May 30 10:04:09 2009 +0000

    Make sure offsets of mjpeg b are within the buffer.
    Fixes issue1132
    
    Originally committed as revision 18996 to svn://svn.ffmpeg.org/ffmpeg/trunk

diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c
index 04ad6c1..185e7bb 100644
--- a/libavcodec/mjpegbdec.c
+++ b/libavcodec/mjpegbdec.c
@@ -28,6 +28,14 @@
 #include "mjpeg.h"
 #include "mjpegdec.h"
 
+static uint32_t read_offs(AVCodecContext *avctx, GetBitContext *gb, uint32_t size, const char *err_msg){
+    uint32_t offs= get_bits_long(gb, 32);
+    if(offs >= size){
+        av_log(avctx, AV_LOG_WARNING, err_msg, offs, size);
+        return 0;
+    }
+    return offs;
+}
 
 static int mjpegb_decode_frame(AVCodecContext *avctx,
                               void *data, int *data_size,
@@ -64,10 +72,10 @@ read_header:
     field_size = get_bits_long(&hgb, 32); /* field size */
     av_log(avctx, AV_LOG_DEBUG, "field size: 0x%x\n", field_size);
     skip_bits(&hgb, 32); /* padded field size */
-    second_field_offs = get_bits_long(&hgb, 32);
+    second_field_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "second_field_offs is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "second field offs: 0x%x\n", second_field_offs);
 
-    dqt_offs = get_bits_long(&hgb, 32);
+    dqt_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dqt is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "dqt offs: 0x%x\n", dqt_offs);
     if (dqt_offs)
     {
@@ -76,7 +84,7 @@ read_header:
         ff_mjpeg_decode_dqt(s);
     }
 
-    dht_offs = get_bits_long(&hgb, 32);
+    dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "dht offs: 0x%x\n", dht_offs);
     if (dht_offs)
     {
@@ -85,7 +93,7 @@ read_header:
         ff_mjpeg_decode_dht(s);
     }
 
-    sof_offs = get_bits_long(&hgb, 32);
+    sof_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "sof offs: 0x%x\n", sof_offs);
     if (sof_offs)
     {
@@ -95,9 +103,9 @@ read_header:
             return -1;
     }
 
-    sos_offs = get_bits_long(&hgb, 32);
+    sos_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sos is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "sos offs: 0x%x\n", sos_offs);
-    sod_offs = get_bits_long(&hgb, 32);
+    sod_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "sof is %d and size is %d\n");
     av_log(avctx, AV_LOG_DEBUG, "sod offs: 0x%x\n", sod_offs);
     if (sos_offs)
     {

-- 
Libav/FFmpeg packaging