diff --git a/libavcodec/mjpegbdec.c b/libavcodec/mjpegbdec.c index be5d853624..a9f94f1c5b 100644 --- a/libavcodec/mjpegbdec.c +++ b/libavcodec/mjpegbdec.c @@ -81,7 +81,9 @@ read_header: { init_get_bits(&s->gb, buf_ptr+dqt_offs, (buf_end - (buf_ptr+dqt_offs))*8); s->start_code = DQT; - ff_mjpeg_decode_dqt(s); + if (ff_mjpeg_decode_dqt(s) < 0 && + avctx->error_recognition >= FF_ER_EXPLODE) + return AVERROR_INVALIDDATA; } dht_offs = read_offs(avctx, &hgb, buf_end - buf_ptr, "dht is %d and size is %d\n"); @@ -113,7 +115,9 @@ read_header: init_get_bits(&s->gb, buf_ptr+sos_offs, field_size*8); s->mjpb_skiptosod = (sod_offs - sos_offs - show_bits(&s->gb, 16)); s->start_code = SOS; - ff_mjpeg_decode_sos(s, NULL, NULL); + if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && + avctx->error_recognition >= FF_ER_EXPLODE) + return AVERROR_INVALIDDATA; } if (s->interlaced) { diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index c4cfd1af18..81effb4f8c 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -1525,7 +1525,9 @@ eoi_parser: av_log(avctx, AV_LOG_WARNING, "Can not process SOS before SOF, skipping\n"); break; } - ff_mjpeg_decode_sos(s, NULL, NULL); + if (ff_mjpeg_decode_sos(s, NULL, NULL) < 0 && + avctx->error_recognition >= FF_ER_EXPLODE) + return AVERROR_INVALIDDATA; /* buggy avid puts EOI every 10-20th frame */ /* if restart period is over process EOI */ if ((s->buggy_avid && !s->interlaced) || s->restart_interval) diff --git a/libavcodec/mxpegdec.c b/libavcodec/mxpegdec.c index e710291501..92fd244ec7 100644 --- a/libavcodec/mxpegdec.c +++ b/libavcodec/mxpegdec.c @@ -275,9 +275,13 @@ static int mxpeg_decode_frame(AVCodecContext *avctx, return AVERROR(ENOMEM); } - ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, reference_ptr); + ret = ff_mjpeg_decode_sos(jpg, s->mxm_bitmask, reference_ptr); + if (ret < 0 && avctx->error_recognition >= FF_ER_EXPLODE) + return ret; } else { - ff_mjpeg_decode_sos(jpg, NULL, NULL); + ret = ff_mjpeg_decode_sos(jpg, NULL, NULL); + if (ret < 0 && avctx->error_recognition >= FF_ER_EXPLODE) + return ret; } break;