Merge commit '7e201d575dc4385eb67314b0419d4d77185e65f4'

* commit '7e201d575dc4385eb67314b0419d4d77185e65f4':
  jpeg2000: Validate block lengthinc

Merged-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavcodec/jpeg2000dec.c b/libavcodec/jpeg2000dec.c
index e7e9a8b005e04e83b4a59186459d0135ca7b445c..0e459c1f7c85f41eea0fb9a68007bd6daf65669f 100644 (file)
--- a/libavcodec/jpeg2000dec.c
+++ b/libavcodec/jpeg2000dec.c
@@ -674,6 +674,12 @@ static int jpeg2000_decode_packet(Jpeg2000DecoderContext *s,
             cblk->lblock += llen;
             if ((ret = get_bits(s, av_log2(newpasses) + cblk->lblock)) < 0)
                 return ret;
+            if (ret > sizeof(cblk->data)) {
+                avpriv_request_sample(s->avctx,
+                                      "Block with lengthinc greater than %zu",
+                                      sizeof(cblk->data));
+                return AVERROR_PATCHWELCOME;
+            }
             cblk->lengthinc = ret;
             cblk->npasses  += newpasses;
         }