har0ke/FFmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

nuv: check RTjpeg header for validity

Browse Source 
CC: libav-stable@libav.org
(cherry picked from commit 859a579e9bbf47fae2e09494c43bcf813dcb2fad)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 6704522ca9dd32c858ee474492be568c386910f9)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit f31170d4e7f9671e019315391160d454b18d7296)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
(cherry picked from commit 459feb7cce03af7154c098171fc9d36fc9d472f6)

Signed-off-by: Anton Khirnov <anton@khirnov.net>
This commit is contained in:
Janne Grunau 2012-08-06 13:59:04 +02:00 committed by Anton Khirnov
parent 9125aa9218
commit f695be22d8
2 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
libavcodec/nuv.c
View File

@ -182,17 +182,18 @@ static int decode_frame(AVCodecContext *avctx, void *data, int *data_size,
} }
if (c->codec_frameheader) { if (c->codec_frameheader) {
int w, h, q; int w, h, q;
if (buf_size < 12) { if (buf_size < RTJPEG_HEADER_SIZE || buf[4] != RTJPEG_HEADER_SIZE ||
buf[5] != RTJPEG_FILE_VERSION) {
av_log(avctx, AV_LOG_ERROR, "invalid nuv video frame\n"); av_log(avctx, AV_LOG_ERROR, "invalid nuv video frame\n");
return -1; return AVERROR_INVALIDDATA;
} }
w = AV_RL16(&buf[6]); w = AV_RL16(&buf[6]);
h = AV_RL16(&buf[8]); h = AV_RL16(&buf[8]);
q = buf[10]; q = buf[10];
if (!codec_reinit(avctx, w, h, q)) if (!codec_reinit(avctx, w, h, q))
return -1; return -1;
buf = &buf[12]; buf = &buf[RTJPEG_HEADER_SIZE];
buf_size -= 12; buf_size -= RTJPEG_HEADER_SIZE;
} }
if (keyframe && c->pic.data[0]) if (keyframe && c->pic.data[0])

3
libavcodec/rtjpeg.h
View File

@ -25,6 +25,9 @@
#include <stdint.h> #include <stdint.h>
#include "dsputil.h" #include "dsputil.h"
#define RTJPEG_FILE_VERSION 0
#define RTJPEG_HEADER_SIZE 12
typedef struct { typedef struct {
int w, h; int w, h;
DSPContext *dsp; DSPContext *dsp;