aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Niedermayer <michaelni@gmx.at>2013-09-12 14:33:25 +0200
committerMichael Niedermayer <michaelni@gmx.at>2013-09-12 14:33:49 +0200
commit72abfba88458b85d24d8b2cebf7f2c06166a834b (patch)
treed0524693e86456ff6d1ce974b6ec5ebf194b8bdb
parent83d2b7e9a25e719b22c6631c31c3fdcfc137fa75 (diff)
parent0f678c0214dccb355ed8955077a2bea46984fbc8 (diff)
downloadffmpeg-72abfba88458b85d24d8b2cebf7f2c06166a834b.tar.gz
Merge commit '0f678c0214dccb355ed8955077a2bea46984fbc8'
* commit '0f678c0214dccb355ed8955077a2bea46984fbc8': aic: Validate values read from the bitstream Conflicts: libavcodec/aic.c See: 657875b145c788d29b8e3bf38f79264e657932ae Merged-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavcodec/aic.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/libavcodec/aic.c b/libavcodec/aic.c
index 70e9f3f103..40c18c690f 100644
--- a/libavcodec/aic.c
+++ b/libavcodec/aic.c
@@ -223,7 +223,7 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst,
break;
GET_CODE(val, coeff_type, coeff_bits);
val++;
- if (val >= 0x10000)
+ if (val >= 0x10000 || val < 0)
return AVERROR_INVALIDDATA;
dst[scan[idx]] = val;
} while (idx < num_coeffs - 1);
@@ -233,7 +233,7 @@ static int aic_decode_coeffs(GetBitContext *gb, int16_t *dst,
for (mb = 0; mb < slice_width; mb++) {
for (idx = 0; idx < num_coeffs; idx++) {
GET_CODE(val, coeff_type, coeff_bits);
- if (val >= 0x10000)
+ if (val >= 0x10000 || val < 0)
return AVERROR_INVALIDDATA;
dst[scan[idx]] = val;
}