[vlc-commits] codec: jpeg: fix read ofw

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Tue Jul 18 10:02:18 2017 +0200| [0ac48909b94de064ff07677f7994d442c404d0cd] | committer: Francois Cartegnie

codec: jpeg: fix read ofw

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=0ac48909b94de064ff07677f7994d442c404d0cd
---

 modules/codec/jpeg.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/modules/codec/jpeg.c b/modules/codec/jpeg.c
index c3119db968..ed8e6b258c 100644
--- a/modules/codec/jpeg.c
+++ b/modules/codec/jpeg.c
@@ -287,7 +287,8 @@ static void jpeg_GetProjection(j_decompress_ptr cinfo, video_format_t *fmt)
     {
         if (cmarker->marker == EXIF_JPEG_MARKER)
         {
-            if (!memcmp(cmarker->data, EXIF_XMP_STRING, 29))
+            if(cmarker->data_length >= 32 &&
+               !memcmp(cmarker->data, EXIF_XMP_STRING, 29))
             {
                 xmp_marker = cmarker;
                 break;
@@ -296,7 +297,7 @@ static void jpeg_GetProjection(j_decompress_ptr cinfo, video_format_t *fmt)
         cmarker = cmarker->next;
     }
 
-    if (xmp_marker == NULL || xmp_marker->data_length < 32)
+    if (xmp_marker == NULL)
         return;
     char *psz_rdf = malloc(xmp_marker->data_length - 29 + 1);
     if (unlikely(psz_rdf == NULL))
@@ -375,7 +376,8 @@ jpeg_GetOrientation( j_decompress_ptr cinfo )
 
     while ( cmarker )
     {
-        if ( cmarker->marker == EXIF_JPEG_MARKER )
+        if ( cmarker->data_length >= 32 &&
+             cmarker->marker == EXIF_JPEG_MARKER )
         {
             /* The Exif APP1 marker should contain a unique
                identification string ("Exif\0\0"). Check for it. */
@@ -391,10 +393,6 @@ jpeg_GetOrientation( j_decompress_ptr cinfo )
     if ( exif_marker == NULL )
         return 0;
 
-    /* Do we have enough data? */
-    if ( exif_marker->data_length < 32 )
-        return 0;
-
     /* Check for TIFF header and catch endianess */
     i = 0;