From 0a28ae573654d05ef56cafbb169674b1829f0c6f Mon Sep 17 00:00:00 2001 From: Paul B Mahol Date: Sun, 25 Sep 2022 19:17:25 +0200 Subject: [PATCH] avcodec/mjpegdec: check that index is not negative Signed-off-by: Paul B Mahol --- libavcodec/mjpegdec.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c index c594950500..57c7c1c80d 100644 --- a/libavcodec/mjpegdec.c +++ b/libavcodec/mjpegdec.c @@ -374,6 +374,8 @@ int ff_mjpeg_decode_sof(MJpegDecodeContext *s) for (i = 0; i < nb_components; i++) { /* component id */ s->component_id[i] = get_bits(&s->gb, 8) - 1; + if (s->component_id[i] < 0) + return AVERROR_INVALIDDATA; h_count[i] = get_bits(&s->gb, 4); v_count[i] = get_bits(&s->gb, 4); /* compute hmax and vmax (only used in interleaved case) */ @@ -1678,6 +1680,8 @@ int ff_mjpeg_decode_sos(MJpegDecodeContext *s, const uint8_t *mb_bitmask, } for (i = 0; i < nb_components; i++) { id = get_bits(&s->gb, 8) - 1; + if (id < 0) + return AVERROR_INVALIDDATA; av_log(s->avctx, AV_LOG_DEBUG, "component: %d\n", id); /* find component index */ for (index = 0; index < s->nb_components; index++) -- 2.37.2