Fix an exploit in indeo by checking we are not writing out of the strip array.

[ffmpeg] / libavcodec / mjpegdec.h

diff --git a/libavcodec/mjpegdec.h b/libavcodec/mjpegdec.h
index c973a9c2a2c4cd9f9bad05c50a2ba6ec376b36bd..b308c91b3c0c99627be256a44be365283718675f 100644 (file)
--- a/libavcodec/mjpegdec.h
+++ b/libavcodec/mjpegdec.h
@@ -1,6 +1,6 @@
 /*
  * MJPEG decoder
- * Copyright (c) 2000, 2001 Fabrice Bellard.
+ * Copyright (c) 2000, 2001 Fabrice Bellard
  * Copyright (c) 2003 Alex Beregszaszi
  * Copyright (c) 2003-2004 Michael Niedermayer
  *
@@ -67,6 +67,7 @@ typedef struct MJpegDecodeContext {
     int width, height;
     int mb_width, mb_height;
     int nb_components;
+    int block_stride[MAX_COMPONENTS];
     int component_id[MAX_COMPONENTS];
     int h_count[MAX_COMPONENTS]; /* horizontal and vertical count for each component */
     int v_count[MAX_COMPONENTS];
@@ -83,6 +84,9 @@ typedef struct MJpegDecodeContext {
     int linesize[MAX_COMPONENTS];                   ///< linesize << interlaced
     int8_t *qscale_table;
     DECLARE_ALIGNED_16(DCTELEM, block[64]);
+    DCTELEM (*blocks[MAX_COMPONENTS])[64]; ///< intermediate sums (progressive mode)
+    uint8_t *last_nnz[MAX_COMPONENTS];
+    uint64_t coefs_finished[MAX_COMPONENTS]; ///< bitmask of which coefs have been completely decoded (progressive mode)
     ScanTable scantable;
     DSPContext dsp;