68 lines
2.2 KiB
Diff
68 lines
2.2 KiB
Diff
From 9abe706a7898b804bf3465e24162fc82b2a28748 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
|
|
Date: Tue, 9 Jun 2026 09:40:41 +0300
|
|
Subject: [PATCH] vajpegdecoder: Validate that enough data is available for the
|
|
current JPEG segment
|
|
|
|
gst_jpeg_parse() does not ensure this and relies on the caller to collect enough
|
|
data. All other users of the function are doing this correctly.
|
|
|
|
Here we can directly error out if not enough data is available as we require
|
|
parsing input.
|
|
|
|
Patch provided by Junyi Liu, who also reported this.
|
|
|
|
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104
|
|
|
|
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11805>
|
|
---
|
|
subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c | 18 ++++++++++++++++++
|
|
1 file changed, 18 insertions(+)
|
|
|
|
diff --git a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
|
|
index 2448c3c..3fccf03 100644
|
|
--- a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
|
|
+++ b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
|
|
@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
|
|
}
|
|
#endif
|
|
|
|
+static gboolean
|
|
+jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
|
|
+{
|
|
+ if (seg->size < 0)
|
|
+ return FALSE;
|
|
+
|
|
+ if ((gsize) seg->offset > size)
|
|
+ return FALSE;
|
|
+
|
|
+ return (gsize) seg->size <= size - (gsize) seg->offset;
|
|
+}
|
|
+
|
|
static GstFlowReturn
|
|
gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
|
|
GstVideoCodecFrame * frame)
|
|
@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
|
|
if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
|
|
goto unmap_and_error;
|
|
|
|
+ if (!jpeg_segment_fits_input (&seg, map.size))
|
|
+ goto unmap_and_error;
|
|
+
|
|
offset = seg.offset + seg.size;
|
|
marker = seg.marker;
|
|
|
|
@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
|
|
if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
|
|
goto unmap_and_error;
|
|
|
|
+ if (!jpeg_segment_fits_input (&seg_scan, map.size))
|
|
+ goto unmap_and_error;
|
|
+
|
|
if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
|
|
|| seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
|
|
break;
|
|
--
|
|
2.52.0
|
|
|