Mercurial > libavcodec.hg
comparison mjpeg.c @ 1061:081b1f28c1ae libavcodec
* check for potentialy problematic field len
author | kabi |
---|---|
date | Mon, 10 Feb 2003 10:45:41 +0000 |
parents | bb5de8a59da8 |
children | b32afefe7d33 |
comparison
equal
deleted
inserted
replaced
1060:e67433f96ae3 | 1061:081b1f28c1ae |
---|---|
1260 return 0; | 1260 return 0; |
1261 } | 1261 } |
1262 | 1262 |
1263 static int mjpeg_decode_com(MJpegDecodeContext *s) | 1263 static int mjpeg_decode_com(MJpegDecodeContext *s) |
1264 { | 1264 { |
1265 int i; | |
1266 UINT8 *cbuf; | |
1267 | |
1268 /* XXX: verify len field validity */ | 1265 /* XXX: verify len field validity */ |
1269 unsigned int len = get_bits(&s->gb, 16)-2; | 1266 unsigned int len = get_bits(&s->gb, 16); |
1270 cbuf = av_malloc(len+1); | 1267 if (len >= 2 && len < 32768) { |
1271 | 1268 /* XXX: any better upper bound */ |
1272 for (i = 0; i < len; i++) | 1269 UINT8 *cbuf = av_malloc(len - 1); |
1273 cbuf[i] = get_bits(&s->gb, 8); | 1270 if (cbuf) { |
1274 if (cbuf[i-1] == '\n') | 1271 int i; |
1275 cbuf[i-1] = 0; | 1272 for (i = 0; i < len - 2; i++) |
1276 else | 1273 cbuf[i] = get_bits(&s->gb, 8); |
1277 cbuf[i] = 0; | 1274 if (i > 0 && cbuf[i-1] == '\n') |
1278 | 1275 cbuf[i-1] = 0; |
1279 printf("mjpeg comment: '%s'\n", cbuf); | 1276 else |
1280 | 1277 cbuf[i] = 0; |
1281 /* buggy avid, it puts EOI only at every 10th frame */ | 1278 |
1282 if (!strcmp(cbuf, "AVID")) | 1279 printf("mjpeg comment: '%s'\n", cbuf); |
1283 { | 1280 |
1284 s->buggy_avid = 1; | 1281 /* buggy avid, it puts EOI only at every 10th frame */ |
1285 // if (s->first_picture) | 1282 if (!strcmp(cbuf, "AVID")) |
1286 // printf("mjpeg: workarounding buggy AVID\n"); | 1283 { |
1287 } | 1284 s->buggy_avid = 1; |
1288 | 1285 // if (s->first_picture) |
1289 av_free(cbuf); | 1286 // printf("mjpeg: workarounding buggy AVID\n"); |
1287 } | |
1288 | |
1289 av_free(cbuf); | |
1290 } | |
1291 } | |
1290 | 1292 |
1291 return 0; | 1293 return 0; |
1292 } | 1294 } |
1293 | 1295 |
1294 #if 0 | 1296 #if 0 |