[FFmpeg-devel] [PATCH 1/2] avcodec/mjpegdec: fix skipping of bytes for unknown APPx markers

[Ramiro Polla]

The loop to skip the remaining bytes was off by one for all markers
except for Adob.

This patch uses post-decrement instead of pre-decrement in the while
loop to make the len value easier to understand, and updates the len
value to reflect this change for the Adob marker.
---
 libavcodec/mjpegdec.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/mjpegdec.c b/libavcodec/mjpegdec.c
index 86ec58713c..a775fdca30 100644
--- a/libavcodec/mjpegdec.c
+++ b/libavcodec/mjpegdec.c
@@ -1931,7 +1931,7 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
     }
 
     if (   id == AV_RB32("Adob")
-        && len >= 7
+        && len >= 8
         && show_bits(&s->gb, 8) == 'e'
         && show_bits_long(&s->gb, 32) != AV_RB32("e_CM")) {
         skip_bits(&s->gb,  8); /* 'e' */
@@ -1941,7 +1941,7 @@ static int mjpeg_decode_app(MJpegDecodeContext *s)
         s->adobe_transform = get_bits(&s->gb,  8);
         if (s->avctx->debug & FF_DEBUG_PICT_INFO)
             av_log(s->avctx, AV_LOG_INFO, "mjpeg: Adobe header found, transform=%d\n", s->adobe_transform);
-        len -= 7;
+        len -= 8;
         goto out;
     }
 
@@ -2162,7 +2162,7 @@ out:
     if (len < 0)
         av_log(s->avctx, AV_LOG_ERROR,
                "mjpeg: error, decode_app parser read over the end\n");
-    while (--len > 0)
+    while (len-- > 0)
         skip_bits(&s->gb, 8);
 
     return 0;
-- 
2.30.2