Skip to content

Commit e786e96

Browse files
committed
lavf/rtpenc_jpeg: Error out for non-standard Huffman tables.
Related to ticket #3823.
1 parent ad7c5cb commit e786e96

File tree

1 file changed

+20
-0
lines changed

1 file changed

+20
-0
lines changed

libavformat/rtpenc_jpeg.c

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121

2222
#include "libavcodec/bytestream.h"
2323
#include "libavcodec/mjpeg.h"
24+
#include "libavcodec/jpegtables.h"
2425
#include "libavutil/intreadwrite.h"
2526
#include "rtpenc.h"
2627

@@ -81,6 +82,25 @@ void ff_rtp_send_jpeg(AVFormatContext *s1, const uint8_t *buf, int size)
8182
"Only 1x1 chroma blocks are supported. Aborted!\n");
8283
return;
8384
}
85+
} else if (buf[i + 1] == DHT) {
86+
if ( AV_RB16(&buf[i + 2]) < 418
87+
|| i + 420 >= size
88+
|| buf[i + 4] != 0x00
89+
|| buf[i + 33] != 0x01
90+
|| buf[i + 62] != 0x10
91+
|| buf[i + 241] != 0x11
92+
|| memcmp(buf + i + 5, avpriv_mjpeg_bits_dc_luminance + 1, 16)
93+
|| memcmp(buf + i + 21, avpriv_mjpeg_val_dc, 12)
94+
|| memcmp(buf + i + 34, avpriv_mjpeg_bits_dc_chrominance + 1, 16)
95+
|| memcmp(buf + i + 50, avpriv_mjpeg_val_dc, 12)
96+
|| memcmp(buf + i + 63, avpriv_mjpeg_bits_ac_luminance + 1, 16)
97+
|| memcmp(buf + i + 79, avpriv_mjpeg_val_ac_luminance, 162)
98+
|| memcmp(buf + i + 242, avpriv_mjpeg_bits_ac_chrominance + 1, 16)
99+
|| memcmp(buf + i + 258, avpriv_mjpeg_val_ac_chrominance, 162)) {
100+
av_log(s1, AV_LOG_ERROR,
101+
"RFC 2435 requires standard Huffman tables for jpeg\n");
102+
return;
103+
}
84104
} else if (buf[i + 1] == SOS) {
85105
/* SOS is last marker in the header */
86106
i += AV_RB16(&buf[i + 2]) + 2;

0 commit comments

Comments
 (0)