From 1018a92219a38a812cf97761c6b3a5e66a400f4b Mon Sep 17 00:00:00 2001
From: Luca Barbato
Date: Wed, 9 Oct 2013 06:17:12 +0200
Subject: jpeg2000: Check block length

Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
---
 libavcodec/jpeg2000dec.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index 18346f9e59..cc154c3522 100644
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -715,6 +715,13 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s,
             }
             cblk->length   += cblk->lengthinc;
             cblk->lengthinc = 0;
+
+            if (cblk->length > sizeof(cblk->data)) {
+                av_log(s->avctx, AV_LOG_ERROR,
+                       "Block length %d > data size %zd\n",
+                       cblk->length, sizeof(cblk->data));
+                return AVERROR_INVALIDDATA;
+            }
         }
     }
     return 0;
-- 
cgit v1.2.3