gstreamer1-plugins-bad-free/0005-vajpegdecoder-Validate-that-enough-data-is-available.patch
2026-07-08 12:57:01 -04:00

68 lines
2.2 KiB
Diff

From 9abe706a7898b804bf3465e24162fc82b2a28748 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Tue, 9 Jun 2026 09:40:41 +0300
Subject: [PATCH] vajpegdecoder: Validate that enough data is available for the
current JPEG segment
gst_jpeg_parse() does not ensure this and relies on the caller to collect enough
data. All other users of the function are doing this correctly.
Here we can directly error out if not enough data is available as we require
parsing input.
Patch provided by Junyi Liu, who also reported this.
Fixes https://gitlab.freedesktop.org/gstreamer/gstreamer/-/work_items/5104
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/11805>
---
subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
index 2448c3c..3fccf03 100644
--- a/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
+++ b/subprojects/gst-plugins-bad/sys/va/gstjpegdecoder.c
@@ -370,6 +370,18 @@ _get_marker_name (guint marker)
}
#endif
+static gboolean
+jpeg_segment_fits_input (const GstJpegSegment * seg, gsize size)
+{
+ if (seg->size < 0)
+ return FALSE;
+
+ if ((gsize) seg->offset > size)
+ return FALSE;
+
+ return (gsize) seg->size <= size - (gsize) seg->offset;
+}
+
static GstFlowReturn
gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
GstVideoCodecFrame * frame)
@@ -399,6 +411,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
if (!gst_jpeg_parse (&seg, map.data, map.size, offset))
goto unmap_and_error;
+ if (!jpeg_segment_fits_input (&seg, map.size))
+ goto unmap_and_error;
+
offset = seg.offset + seg.size;
marker = seg.marker;
@@ -445,6 +460,9 @@ gst_jpeg_decoder_handle_frame (GstVideoDecoder * decoder,
if (!gst_jpeg_parse (&seg_scan, map.data, map.size, offset))
goto unmap_and_error;
+ if (!jpeg_segment_fits_input (&seg_scan, map.size))
+ goto unmap_and_error;
+
if (seg_scan.marker < GST_JPEG_MARKER_RST_MIN
|| seg_scan.marker > GST_JPEG_MARKER_RST_MAX)
break;
--
2.52.0