[FFmpeg-devel] [PATCH] avcodec/mjpegdec: Explain buf_size/width/height check (PR #20495)

[michaelni via ffmpeg-devel <ffmpeg-devel@ffmpeg.org>]

PR #20495 opened by michaelni
URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20495
Patch URL: https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/20495.patch

Suggested-by: Ramiro

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>


>From 16ba3a971069e4013ff86229df4a9a1d30d12074 Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michael@niedermayer.cc>
Date: Thu, 11 Sep 2025 20:12:55 +0200
Subject: [PATCH] avcodec/mjpegdec: Explain buf_size/width/height check

Suggested-by: Ramiro

Signed-off-by: Michael Niedermayer <michael@niedermayer.cc>
---
 libavcodec/mjpegdec.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 3dde759fea..76a98bb521 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -342,6 +342,9 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s)
     av_log(s->avctx, AV_LOG_DEBUG, "sof0: picture: %dx%d\n", width, height);
     if (av_image_check_size(width, height, 0, s->avctx) < 0)
         return AVERROR_INVALIDDATA;
+
+    // can the smallest valid representation (of blank 8x8 blocks) be in buf_size ?
+    // if thats not possible than this cannot be a valid frame
     if (s->buf_size && (width + 7) / 8 * ((height + 7) / 8) > s->buf_size * 4LL)
         return AVERROR_INVALIDDATA;
 
-- 
2.49.1

_______________________________________________
ffmpeg-devel mailing list -- ffmpeg-devel@ffmpeg.org
To unsubscribe send an email to ffmpeg-devel-leave@ffmpeg.org