* check for potentialy problematic field len

Originally committed as revision 1572 to svn://svn.ffmpeg.org/ffmpeg/trunk

libavcodec/mjpeg.c

@@ -1262,16 +1262,16 @@ out:
 
 static int mjpeg_decode_com(MJpegDecodeContext *s)
 {
-    int i;
-    UINT8 *cbuf;
-
     /* XXX: verify len field validity */
-    unsigned int len = get_bits(&s->gb, 16)-2;
-    cbuf = av_malloc(len+1);
-
-    for (i = 0; i < len; i++)
+    unsigned int len = get_bits(&s->gb, 16);
+    if (len >= 2 && len < 32768) {
+	/* XXX: any better upper bound */
+	UINT8 *cbuf = av_malloc(len - 1);
+	if (cbuf) {
+	    int i;
+	    for (i = 0; i < len - 2; i++)
 		cbuf[i] = get_bits(&s->gb, 8);
-    if (cbuf[i-1] == '\n')
+	    if (i > 0 && cbuf[i-1] == '\n')
 		cbuf[i-1] = 0;
 	    else
 		cbuf[i] = 0;
@@ -1287,6 +1287,8 @@ static int mjpeg_decode_com(MJpegDecodeContext *s)
 	    }
 
 	    av_free(cbuf);
+	}
+    }
 
     return 0;
 }