diff options
| author | David Hoyt <dhoyt@llnl.gov> | 2010-02-22 20:55:29 +0100 |
|---|---|---|
| committer | Sebastian Dröge <sebastian.droege@collabora.co.uk> | 2010-02-22 20:55:29 +0100 |
| commit | ad05705afb0c7f29c28916e805a681588e821c03 (patch) | |
| tree | b7f98251e85bec09ad05eb0c8294bf7fdddca649 | |
| parent | 3ab666762fa6da97f66c8398d2ac6ec697da5708 (diff) | |
jpegdec: Fix invalid memory access by first checking and then reading
Fixes bug #610483.
| -rw-r--r-- | ext/jpeg/gstjpegdec.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/ext/jpeg/gstjpegdec.c b/ext/jpeg/gstjpegdec.c index 91bca5551..f90911cc2 100644 --- a/ext/jpeg/gstjpegdec.c +++ b/ext/jpeg/gstjpegdec.c @@ -486,10 +486,10 @@ gst_jpeg_dec_parse_image_data (GstJpegDec * dec) GST_DEBUG ("0x%08" G_GINT64_MODIFIER "x: finding entropy segment length", (gint64) (data - start - 1)); while (1) { - if (d2[eseglen] == 0xff && d2[eseglen + 1] != 0x00) - break; if (d2 + eseglen >= end - 1) return 0; /* need more data */ + if (d2[eseglen] == 0xff && d2[eseglen + 1] != 0x00) + break; ++eseglen; } frame_len += eseglen; |