GNOME Bugzilla – Bug 610483
[jpegdec] invalid memory access
Last modified: 2010-02-22 19:56:27 UTC
Created attachment 154234 [details] [review] gstjpegdec.c patch line 489 includes this code: d2[eseglen + 1] != 0x00 This caused a crash with jpeg frames coming off of a motion jpeg camera. It was very intermittent - only about once every 1-2 days. Presumably this was b/c of an invalid/corrupted frame. Unfortunately I haven't captured the frame in question, but this seems to have resolved it.
We should look at that before the release. The code looks extremely similar to the code I fixed in jpegparse a few days ago. Shame we don't have a sample.
I've been running this patch for several days without a problem -- in fact, I'm running many instances of gst-launch using the patch and they're all still just fine. I'm running: souphttpsrc location=http://.../ ! decodebin2 ! ffmpegcolorspace ! queue ! autovideosink
This patch is definitely correct. end is data + size, i.e. the first position that must not be read. Moving this check above the memory access makes sure that it never accesses that byte.
commit ad05705afb0c7f29c28916e805a681588e821c03 Author: David Hoyt <dhoyt@llnl.gov> Date: Mon Feb 22 20:55:29 2010 +0100 jpegdec: Fix invalid memory access by first checking and then reading Fixes bug #610483.