GNOME Bugzilla – Bug 173044
[PATCH to ffmpeg] Memory error in mjpeg_decode_frame
Last modified: 2005-04-09 07:46:37 UTC
In the function mjpeg_decode_frame (mjpeg.c): buf_ptr = buf; buf_end = buf + buf_size; but in find_marker: while (buf_ptr < buf_end) { v = *buf_ptr++; v2 = *buf_ptr; ... So if buf_ptr == (buf_end - 1), v2 = buf_ptr[buf_end] and this gives [Invalid read of size 1]. I think that buf_end should be declared as buf_end = buf + buf_size - 1;
Then it won't read the last v. if (buf_ptr != buf_end) v2 = *buf_ptr; sounds like a better fix, although it adds quite some cycles...
Hm, nm, you're correct.
Created attachment 39832 [details] [review] correct patch This should prevent the memory overrun but still work fine for any input
Ok, it works for me. I was thinking that: buf_ptr = pointer to the start of the buffer buf_end = pointer to the last byte of the buffer and so size would be (end - start + 1). Instead it seems that buf_end is "pointer to the last bye of the buffer + 1".
Fixed.