X-Git-Url: https://git.sesse.net/?a=blobdiff_plain;f=libavcodec%2Fjpeglsdec.c;h=df72ca338f2fa045925aded463a686891bb382c5;hb=e7cd53bf662a93330810981f1d057bdf2ead669e;hp=cec561226a29d70ac5adc8d4bf9da12f79a32532;hpb=a5a0ef5e13a59ff53318a45d77c5624b23229c6f;p=ffmpeg

diff --git a/libavcodec/jpeglsdec.c b/libavcodec/jpeglsdec.c
index cec561226a2..df72ca338f2 100644
--- a/libavcodec/jpeglsdec.c
+++ b/libavcodec/jpeglsdec.c
@@ -274,7 +274,7 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
     int i, t = 0;
     uint8_t *zero, *last, *cur;
     JLSState *state;
-    int off = 0, stride = 1, width, shift;
+    int off = 0, stride = 1, width, shift, ret = 0;
 
     zero = av_mallocz(s->picture_ptr->linesize[0]);
     last = zero;
@@ -306,6 +306,10 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
     av_dlog(s->avctx, "JPEG params: ILV=%i Pt=%i BPP=%i, scan = %i\n",
             ilv, point_transform, s->bits, s->cur_scan);
     if (ilv == 0) { /* separate planes */
+        if (s->cur_scan > s->nb_components) {
+            ret = AVERROR_INVALIDDATA;
+            goto end;
+        }
         off    = s->cur_scan - 1;
         stride = (s->nb_components > 1) ? 3 : 1;
         width  = s->width * stride;
@@ -347,9 +351,8 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
         }
     } else if (ilv == 2) { /* sample interleaving */
         avpriv_report_missing_feature(s->avctx, "Sample interleaved images");
-        av_free(state);
-        av_free(zero);
-        return AVERROR_PATCHWELCOME;
+        ret = AVERROR_PATCHWELCOME;
+        goto end;
     }
 
     if (shift) { /* we need to do point transform or normalize samples */
@@ -375,10 +378,12 @@ int ff_jpegls_decode_picture(MJpegDecodeContext *s, int near,
             }
         }
     }
+
+end:
     av_free(state);
     av_free(zero);
 
-    return 0;
+    return ret;
 }
 
 AVCodec ff_jpegls_decoder = {