diff options
| author | Alex Converse <alex.converse@gmail.com> | 2011-11-17 10:06:14 -0800 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2011-11-21 21:57:27 +0100 |
| commit | 37cc48861d7898c27d4b95cf890e01ba44ddae02 (patch) | |
| tree | 12b650ceef8a747c3cb664a2fabd5b0ded68d693 | |
| parent | 0cd61bfa6d6ecf2ab57da8496858473158c4ea35 (diff) | |
| download | ffmpeg-37cc48861d7898c27d4b95cf890e01ba44ddae02.tar.gz | |
vp5: Fix illegal read.
Found with Address Sanitizer
(cherry picked from commit bb4b0ad83b13c3af57675e80163f3f333adef96f)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit f62fa1ce9f12e4a43b41401a7416c6fa8da579c9)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vp5.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/vp5.c b/libavcodec/vp5.c index dfa2a1b094..c32f4f050e 100644 --- a/libavcodec/vp5.c +++ b/libavcodec/vp5.c @@ -199,7 +199,8 @@ static void vp5_parse_coeff(VP56Context *s) model1 = model->coeff_dccv[pt]; model2 = model->coeff_dcct[pt][ctx]; - for (coeff_idx=0; coeff_idx<64; ) { + coeff_idx = 0; + for (;;) { if (vp56_rac_get_prob(c, model2[0])) { if (vp56_rac_get_prob(c, model2[2])) { if (vp56_rac_get_prob(c, model2[3])) { @@ -236,8 +237,11 @@ static void vp5_parse_coeff(VP56Context *s) ct = 0; s->coeff_ctx[vp56_b6to4[b]][coeff_idx] = 0; } + coeff_idx++; + if (coeff_idx >= 64) + break; - cg = vp5_coeff_groups[++coeff_idx]; + cg = vp5_coeff_groups[coeff_idx]; ctx = s->coeff_ctx[vp56_b6to4[b]][coeff_idx]; model1 = model->coeff_ract[pt][ct][cg]; model2 = cg > 2 ? model1 : model->coeff_acct[pt][ct][cg][ctx]; |