diff options
| author | Luca Barbato <lu_zero@gentoo.org> | 2013-10-13 03:30:06 +0200 |
|---|---|---|
| committer | Reinhard Tartler <siretart@tauware.de> | 2014-02-02 12:36:15 -0500 |
| commit | e964207e6c17c358b5a42d281f0da740044c240c (patch) | |
| tree | 99a033ecf0dddfa73ba26e116a90dc203c4e90b1 | |
| parent | 2c0bfce4cb2d92f6add16fa09737865417fd226b (diff) | |
| download | ffmpeg-e964207e6c17c358b5a42d281f0da740044c240c.tar.gz | |
cavs: Check for negative cbp
Sample-Id: 00000647-google
Reported-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
CC: libav-stable@libav.org
(cherry picked from commit c85e5f13f6ac9c4c90125e7671d89009e57f9df9)
Signed-off-by: Reinhard Tartler <siretart@tauware.de>
Conflicts:
libavcodec/cavsdec.c
| -rw-r--r-- | libavcodec/cavsdec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/cavsdec.c b/libavcodec/cavsdec.c index 5582fd42d3..7521c2972e 100644 --- a/libavcodec/cavsdec.c +++ b/libavcodec/cavsdec.c @@ -165,8 +165,8 @@ static inline int decode_residual_inter(AVSContext *h) { /* get coded block pattern */ int cbp= get_ue_golomb(&h->s.gb); - if(cbp > 63){ - av_log(h->s.avctx, AV_LOG_ERROR, "illegal inter cbp\n"); + if(cbp > 63 || cbp < 0){ + av_log(h->s.avctx, AV_LOG_ERROR, "illegal inter cbp %d\n", cbp); return -1; } h->cbp = cbp_tab[cbp][1]; @@ -225,7 +225,7 @@ static int decode_mb_i(AVSContext *h, int cbp_code) { /* get coded block pattern */ if(h->pic_type == AV_PICTURE_TYPE_I) cbp_code = get_ue_golomb(gb); - if(cbp_code > 63){ + if(cbp_code > 63 || cbp_code < 0 ){ av_log(h->s.avctx, AV_LOG_ERROR, "illegal intra cbp\n"); return -1; } |