diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-04-18 02:47:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2014-01-16 00:35:12 +0100 |
| commit | 08a319549a4198150f92be8cd36f06b7ec1d9eb3 (patch) | |
| tree | 93ac65b40e1bbab4981fbb6988783cf7832daee4 | |
| parent | d1da1c8384c625f2ecb0040c60702ebb5523a0d1 (diff) | |
| download | ffmpeg-08a319549a4198150f92be8cd36f06b7ec1d9eb3.tar.gz | |
avcodec/bitstream: Check bits in ff_init_vlc_sparse()
Fixes out of array reads
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit fb3e3808aed843b21dd70a70bdbc4b9f7de6a00b)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/bitstream.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/libavcodec/bitstream.c b/libavcodec/bitstream.c index 6bcdadb9c4..6598d3e397 100644 --- a/libavcodec/bitstream.c +++ b/libavcodec/bitstream.c @@ -305,6 +305,10 @@ int ff_init_vlc_sparse(VLC *vlc, int nb_bits, int nb_codes, GET_DATA(buf[j].bits, bits, i, bits_wrap, bits_size);\ if (!(condition))\ continue;\ + if (buf[j].bits > 3*nb_bits || buf[j].bits>32) {\ + av_log(NULL, AV_LOG_ERROR, "Too long VLC in init_vlc\n");\ + return -1;\ + }\ GET_DATA(buf[j].code, codes, i, codes_wrap, codes_size);\ if (flags & INIT_VLC_LE)\ buf[j].code = bitswap_32(buf[j].code);\ |