diff options
| author | Jérôme Laheurte <jlaheurte@quividi.net> | 2020-09-10 11:24:32 +0200 |
|---|---|---|
| committer | GStreamer Merge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2020-09-25 13:44:50 +0000 |
| commit | f89cad718f33c21eba1c3a0d79abbd8e0c9887dd (patch) | |
| tree | 0b31e6016385ff441e456970ff098c88a4596c9b | |
| parent | 310dec75cd0b630a765ee93c82a473e17fb5dd94 (diff) | |
| download | gstreamer-plugins-good-f89cad718f33c21eba1c3a0d79abbd8e0c9887dd.tar.gz | |
jpegdec: check buffer size before dereferencing. Fixes #541
Some cameras (Panacast) have buggy drivers/firmware which send
invalid JPEG frames, containing no data, which makes jpegdec
crash because it assumes the frame is at least 2 bytes long.
Part-of: <https://gitlab.freedesktop.org/gstreamer/gst-plugins-good/-/merge_requests/750>
| -rw-r--r-- | ext/jpeg/gstjpegdec.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/ext/jpeg/gstjpegdec.c b/ext/jpeg/gstjpegdec.c index aa868359c..396a95ae9 100644 --- a/ext/jpeg/gstjpegdec.c +++ b/ext/jpeg/gstjpegdec.c @@ -1210,6 +1210,8 @@ gst_jpeg_dec_handle_frame (GstVideoDecoder * bdec, GstVideoCodecFrame * frame) data = dec->current_frame_map.data; nbytes = dec->current_frame_map.size; + if (nbytes < 2) + goto need_more_data; has_eoi = ((data[nbytes - 2] == 0xff) && (data[nbytes - 1] == 0xd9)); /* some cameras fail to send an end-of-image marker (EOI), |