comparison mjpeg.c @ 1061:081b1f28c1ae libavcodec

* check for potentialy problematic field len
author kabi
date Mon, 10 Feb 2003 10:45:41 +0000
parents bb5de8a59da8
children b32afefe7d33
comparison
equal deleted inserted replaced
1060:e67433f96ae3 1061:081b1f28c1ae
1260 return 0; 1260 return 0;
1261 } 1261 }
1262 1262
1263 static int mjpeg_decode_com(MJpegDecodeContext *s) 1263 static int mjpeg_decode_com(MJpegDecodeContext *s)
1264 { 1264 {
1265 int i;
1266 UINT8 *cbuf;
1267
1268 /* XXX: verify len field validity */ 1265 /* XXX: verify len field validity */
1269 unsigned int len = get_bits(&s->gb, 16)-2; 1266 unsigned int len = get_bits(&s->gb, 16);
1270 cbuf = av_malloc(len+1); 1267 if (len >= 2 && len < 32768) {
1271 1268 /* XXX: any better upper bound */
1272 for (i = 0; i < len; i++) 1269 UINT8 *cbuf = av_malloc(len - 1);
1273 cbuf[i] = get_bits(&s->gb, 8); 1270 if (cbuf) {
1274 if (cbuf[i-1] == '\n') 1271 int i;
1275 cbuf[i-1] = 0; 1272 for (i = 0; i < len - 2; i++)
1276 else 1273 cbuf[i] = get_bits(&s->gb, 8);
1277 cbuf[i] = 0; 1274 if (i > 0 && cbuf[i-1] == '\n')
1278 1275 cbuf[i-1] = 0;
1279 printf("mjpeg comment: '%s'\n", cbuf); 1276 else
1280 1277 cbuf[i] = 0;
1281 /* buggy avid, it puts EOI only at every 10th frame */ 1278
1282 if (!strcmp(cbuf, "AVID")) 1279 printf("mjpeg comment: '%s'\n", cbuf);
1283 { 1280
1284 s->buggy_avid = 1; 1281 /* buggy avid, it puts EOI only at every 10th frame */
1285 // if (s->first_picture) 1282 if (!strcmp(cbuf, "AVID"))
1286 // printf("mjpeg: workarounding buggy AVID\n"); 1283 {
1287 } 1284 s->buggy_avid = 1;
1288 1285 // if (s->first_picture)
1289 av_free(cbuf); 1286 // printf("mjpeg: workarounding buggy AVID\n");
1287 }
1288
1289 av_free(cbuf);
1290 }
1291 }
1290 1292
1291 return 0; 1293 return 0;
1292 } 1294 }
1293 1295
1294 #if 0 1296 #if 0