Mercurial > libavcodec.hg
diff mjpeg.c @ 2789:587ed6630b5d libavcodec
check len (should fix #1165694)
author | michael |
---|---|
date | Mon, 11 Jul 2005 23:39:47 +0000 |
parents | e25782262d7d |
children | eb488002ab4a |
line wrap: on
line diff
--- a/mjpeg.c Mon Jul 11 22:56:23 2005 +0000 +++ b/mjpeg.c Mon Jul 11 23:39:47 2005 +0000 @@ -1585,10 +1585,11 @@ { int len, id; - /* XXX: verify len field validity */ len = get_bits(&s->gb, 16); if (len < 5) return -1; + if(8*len + get_bits_count(&s->gb) > s->gb.size_in_bits) + return -1; id = (get_bits(&s->gb, 16) << 16) | get_bits(&s->gb, 16); id = be2me_32(id);