jpegdec: Fix invalid memory access by first checking and then reading

Fixes bug #610483.
This commit is contained in:
David Hoyt 2010-02-22 20:55:29 +01:00 committed by Sebastian Dröge
parent 3ab666762f
commit ad05705afb

View file

@ -486,10 +486,10 @@ gst_jpeg_dec_parse_image_data (GstJpegDec * dec)
GST_DEBUG ("0x%08" G_GINT64_MODIFIER "x: finding entropy segment length", GST_DEBUG ("0x%08" G_GINT64_MODIFIER "x: finding entropy segment length",
(gint64) (data - start - 1)); (gint64) (data - start - 1));
while (1) { while (1) {
if (d2[eseglen] == 0xff && d2[eseglen + 1] != 0x00)
break;
if (d2 + eseglen >= end - 1) if (d2 + eseglen >= end - 1)
return 0; /* need more data */ return 0; /* need more data */
if (d2[eseglen] == 0xff && d2[eseglen + 1] != 0x00)
break;
++eseglen; ++eseglen;
} }
frame_len += eseglen; frame_len += eseglen;