mjpegdec: extend check for incompatible values of s->rgb and s->ls
authorAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 31 Dec 2015 15:55:43 +0000 (16:55 +0100)
committerAndreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
Thu, 28 Jan 2016 01:15:49 +0000 (02:15 +0100)
commit46fcc2ba55df8ac2475d6977e8e220fcd5e5f169
treed8697a1b9f7d9650ae057e7ec75eff24338e672a
parenta2667c60ecc3f1f037d996dc2ce8422dbef2e57b
mjpegdec: extend check for incompatible values of s->rgb and s->ls

This can happen if s->ls changes from 0 to 1, but picture allocation is
skipped due to s->interlaced.

In that case ff_jpegls_decode_picture could be called even though the
s->picture_ptr frame has the wrong pixel format and thus a wrong
linesize, which results in a too small zero buffer being allocated.

This fixes an out-of-bounds read in ls_decode_line.

Reviewed-by: Michael Niedermayer <michael@niedermayer.cc>
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
(cherry picked from commit 7ea2db6eafa0a8a9497aab20be2cfc8742a59072)
Signed-off-by: Andreas Cadhalpun <Andreas.Cadhalpun@googlemail.com>
libavcodec/mjpegdec.c