lavc/mjpegdec: Only read JFIF thumbnail size if the segment is long enough.

Fixes ticket #5805.
pull/230/head
Carl Eugen Hoyos 8 years ago
parent b4d7c1f84b
commit e82b181f80
  1. 5
      libavcodec/mjpegdec.c
  2. 2
      libavcodec/version.h

@ -1690,6 +1690,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
s->avctx->sample_aspect_ratio.num, s->avctx->sample_aspect_ratio.num,
s->avctx->sample_aspect_ratio.den); s->avctx->sample_aspect_ratio.den);
len -= 8;
if (len >= 2) {
t_w = get_bits(&s->gb, 8); t_w = get_bits(&s->gb, 8);
t_h = get_bits(&s->gb, 8); t_h = get_bits(&s->gb, 8);
if (t_w && t_h) { if (t_w && t_h) {
@ -1697,7 +1699,8 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
if (len -10 - (t_w * t_h * 3) > 0) if (len -10 - (t_w * t_h * 3) > 0)
len -= t_w * t_h * 3; len -= t_w * t_h * 3;
} }
len -= 10; len -= 2;
}
goto out; goto out;
} }

@ -29,7 +29,7 @@
#define LIBAVCODEC_VERSION_MAJOR 57 #define LIBAVCODEC_VERSION_MAJOR 57
#define LIBAVCODEC_VERSION_MINOR 54 #define LIBAVCODEC_VERSION_MINOR 54
#define LIBAVCODEC_VERSION_MICRO 101 #define LIBAVCODEC_VERSION_MICRO 102
#define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \ #define LIBAVCODEC_VERSION_INT AV_VERSION_INT(LIBAVCODEC_VERSION_MAJOR, \
LIBAVCODEC_VERSION_MINOR, \ LIBAVCODEC_VERSION_MINOR, \

Loading…
Cancel
Save