diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2013-03-28 03:16:01 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2013-03-28 04:01:34 +0100 |
| commit | 10ece44d0948b44b062d09319052d09d14f7bfdb (patch) | |
| tree | ec05431de72145f7e199c30432ca3216acc4306b | |
| parent | ea9a6709a9412d55012321260f8234253c873491 (diff) | |
| download | ffmpeg-10ece44d0948b44b062d09319052d09d14f7bfdb.tar.gz | |
h264_cavlc: fix assertion failure due to reading too long vlc
Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/h264_cavlc.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/libavcodec/h264_cavlc.c b/libavcodec/h264_cavlc.c index d06c86a6f4..dad819f93a 100644 --- a/libavcodec/h264_cavlc.c +++ b/libavcodec/h264_cavlc.c @@ -549,9 +549,15 @@ static int decode_residual(H264Context *h, GetBitContext *gb, int16_t *block, in if(prefix<15){ level_code = (prefix<<suffix_length) + get_bits(gb, suffix_length); }else{ - level_code = (15<<suffix_length) + get_bits(gb, prefix-3); - if(prefix>=16) + level_code = 15<<suffix_length; + if (prefix>=16) { + if(prefix > 25+3){ + av_log(h->avctx, AV_LOG_ERROR, "Invalid level prefix\n"); + return AVERROR_INVALIDDATA; + } level_code += (1<<(prefix-3))-4096; + } + level_code += get_bits(gb, prefix-3); } mask= -(level_code&1); level_code= (((2+level_code)>>1) ^ mask) - mask; |