avcodec/mjpegdec: fix overread in find_marker()

Found-by: Laurent Butti <laurentb@gmail.com>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer 2013-08-23 04:14:08 +02:00
parent 2baa12f1d1
commit 16a0d75c76

View File

@ -1610,7 +1610,7 @@ static int find_marker(const uint8_t **pbuf_ptr, const uint8_t *buf_end)
int skipped = 0;
buf_ptr = *pbuf_ptr;
while (buf_ptr < buf_end) {
while (buf_end - buf_ptr > 1) {
v = *buf_ptr++;
v2 = *buf_ptr;
if ((v == 0xff) && (v2 >= 0xc0) && (v2 <= 0xfe) && buf_ptr < buf_end) {
@ -1619,6 +1619,7 @@ static int find_marker(const uint8_t **pbuf_ptr, const uint8_t *buf_end)
}
skipped++;
}
buf_ptr = buf_end;
val = -1;
found:
av_dlog(NULL, "find_marker skipped %d bytes\n", skipped);