diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-12-14 01:07:34 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-12-14 01:46:11 +0100 |
| commit | 48016f8febe62ee8c46621f592bd3d9999c84c26 (patch) | |
| tree | d4cd17fa628575fa86521517f0b1ad28240da3ee | |
| parent | 5f00b333a4c3cae7a16bfc94a463ee3b6d97fc21 (diff) | |
| download | ffmpeg-48016f8febe62ee8c46621f592bd3d9999c84c26.tar.gz | |
avcodec/vc1dec: propagate errors from vc1_parse_sprites()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/vc1dec.c | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/libavcodec/vc1dec.c b/libavcodec/vc1dec.c index daa62d6298..061ece13c5 100644 --- a/libavcodec/vc1dec.c +++ b/libavcodec/vc1dec.c @@ -5288,7 +5288,7 @@ static void vc1_sprite_parse_transform(GetBitContext* gb, int c[7]) c[6] = 1 << 16; } -static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd) +static int vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd) { AVCodecContext *avctx = v->s.avctx; int sprite, i; @@ -5332,7 +5332,7 @@ static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd) sd->effect_pcount2 = get_bits(gb, 16); if (sd->effect_pcount2 > 10) { av_log(avctx, AV_LOG_ERROR, "Too many effect parameters\n"); - return; + return AVERROR_INVALIDDATA; } else if (sd->effect_pcount2) { i = -1; av_log(avctx, AV_LOG_DEBUG, "Effect params 2: "); @@ -5349,10 +5349,14 @@ static void vc1_parse_sprites(VC1Context *v, GetBitContext* gb, SpriteData* sd) av_log(avctx, AV_LOG_DEBUG, "Effect flag set\n"); if (get_bits_count(gb) >= gb->size_in_bits + - (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0)) + (avctx->codec_id == AV_CODEC_ID_WMV3IMAGE ? 64 : 0)) { av_log(avctx, AV_LOG_ERROR, "Buffer overrun\n"); + return AVERROR_INVALIDDATA; + } if (get_bits_count(gb) < gb->size_in_bits - 8) av_log(avctx, AV_LOG_WARNING, "Buffer not fully read\n"); + + return 0; } static void vc1_draw_sprites(VC1Context *v, SpriteData* sd) @@ -5461,7 +5465,9 @@ static int vc1_decode_sprites(VC1Context *v, GetBitContext* gb) memset(&sd, 0, sizeof(sd)); - vc1_parse_sprites(v, gb, &sd); + ret = vc1_parse_sprites(v, gb, &sd); + if (ret < 0) + return ret; if (!s->current_picture.f.data[0]) { av_log(avctx, AV_LOG_ERROR, "Got no sprites\n"); |